Google's Chrome 156 update fixes 353 security vulnerabilities, and six of them carry a Critical rating, the highest severity level Google uses. If you run Chrome on a computer or an Android phone, install the update now, because a fix only takes effect after the browser restarts.
Google moved Chrome 156 to the stable channel on October 20, 2026, for Windows, macOS and Linux, according to SecurityWeek and Cryptika. Chrome is the most widely used browser in the United States, so a release this size reaches a large number of people. Coverage describes the rollout as happening "over the coming days and weeks," which means many machines will run older builds for several more days.
USA 24 has reported a smaller, 10-flaw Chrome patch before. This release is a much bigger event. It contains more than 35 times that count, and AI-assisted tools played a visible role in finding some of the bugs.
Chrome 156 security fixes: where the 353 flaws sit
Most of the fixes are memory-safety bugs. SecurityWeek counts 163 memory corruption bugs, 125 use-after-free bugs and 17 out-of-bounds reads, plus 36 improper input validation flaws. Those four categories add up to 341 of the 353 fixes.
Memory-safety bugs are a common route to code execution. A malicious web page can sometimes trigger one of these flaws and push the browser's own code into doing something its designers did not intend. Browsers written largely in C and C++ have struggled with this bug class for years, so a release dominated by it shows where much of the remaining risk sits.
Severity is a separate question. TechMitra breaks Google's list into 6 Critical, 61 High, 197 Medium and 89 Low. That split comes from a third-party count, not from Google, so treat it as an outside estimate.
One bounty stands out: $10,000 for CVE-2026-113101, a SiteIsolation use-after-free credited to a researcher at VinFast, according to Cyberpress.
Chrome 156 update: which builds are patched
Check your browser against the fixed builds that The Hans India and NewsBytes both report:
- Windows: 156.0.8078.47 or 156.0.8078.48
- macOS: 156.0.8078.47 or 156.0.8078.48
- Linux: 156.0.8078.47
Google has not published full affected-version ranges for these bugs, according to Cryptika. The build numbers above are the patched targets, not a complete list of vulnerable versions.
The rollout is gradual. A user may see the update prompt later than the release date, so checking the version number is more reliable than waiting for a notification.
The six Critical bugs and who reported them
Cyberpress and TechMitra place the six Critical bugs in Skia (graphics), Accessibility, CSS, Paint and WebRTC. The table lists each CVE, its component and any reporter the sources named.
| CVE | Component | Credited reporter |
|---|---|---|
| CVE-2026-113341 | Skia (graphics) | Not named |
| CVE-2026-113279 | Accessibility | Not named |
| CVE-2026-113271 | Accessibility | Researcher at Anthropic working with Claude |
| CVE-2026-113072 | CSS | Not named |
| CVE-2026-113280 | Paint | Not named |
| CVE-2026-113303 | WebRTC | OpenAI Codex Security |
Google's notice does not say that any of the six Critical bugs is being exploited in attacks. It also says bug details may stay restricted until most users are patched, according to Cryptika. Holding back technical details gives people time to update, but it also leaves defenders with less to work with for a while.
How AI-assisted tools are finding browser bugs
Google credits AI-assisted discovery for some of the fixes. CVE-2026-113271 came from a researcher at Anthropic working with Claude, and CVE-2026-113303 was reported through OpenAI Codex Security, according to Cyberpress and TechMitra.
That detail will matter well beyond Chrome. Chrome already has a large security program, yet one stable release carried 353 fixes, and AI tools are now part of how those bugs get found. More reports mean more triage work for engineers and more pressure to ship fixes in large batches, which is what this release looks like.
The sources do not say how many of the 353 fixes came from AI-assisted discovery, so the full scale of AI's role remains unclear.
How to update Chrome on Windows and Mac now
Use these steps on a Windows PC, a Mac or a Linux machine:
- Open Chrome and click the three-dot menu in the top-right corner.
- Choose Help, then About Google Chrome.
- Compare the version number with the builds listed above. You need 156.0.8078.47 or .48 on Windows and Mac, and 156.0.8078.47 or later on Linux.
- Restart Chrome. The update applies at restart, not when the download finishes, so a browser left open for days stays unpatched.
If the About page still shows an older build, let Chrome finish checking and try again later, since the rollout is gradual.
IT teams on managed devices can use Chrome Enterprise policies to prompt users to update or to require restarts after an update, according to Cryptika. Admins should verify versions across managed fleets rather than assume a prompt has reached every machine.
What to watch next as attackers study the release
Several questions remain open. Google has not said whether any of the 353 bugs is being exploited in the wild. USA 24 did not find a CISA Known Exploited Vulnerabilities listing for these Chrome CVEs in its searches, and whether one follows is unknown.
Speed is the variable to watch. USA 24 has reported that Plex2Shell exploits hit unpatched Plex servers within a day, and attackers were already hitting Atlassian's CVE-2026-21589 in Jira and Confluence. Those cases show how quickly criminals move once a flaw becomes public.
The next signals will come from Google's follow-up notices and any public detail on the six Critical bugs. If those details appear before most users update, the gap between a fix and a working exploit could shrink fast. Until then, the job is simple: check the version, restart the browser and confirm the number.
