Chrome 156 fixes 353 security flaws, six of them critical

Google has released Chrome 156 to the stable channel with patches for 353 security vulnerabilities, SecurityWeek reported on October 21. Six of the flaws are rated critical, and the vast majority stem from memory safety issues, making this a sizeable update that users and IT teams should roll out promptly even though no active exploitation has been reported.

What happened

According to SecurityWeek, Google announced on Tuesday, October 20, that Chrome 156 had been promoted to stable as version 156.0.8078.47/.48 for Windows and macOS and 156.0.8078.47 for Linux. The release resolves 353 vulnerabilities in total: six rated critical, 61 high, 197 medium and 89 low severity. The publication said Google makes no mention of any of the vulnerabilities being exploited in the wild.

Technical details

SecurityWeek's breakdown shows memory bugs dominate the release. It lists 163 memory corruption issues, 125 use-after-free flaws and 17 out-of-bounds reads, along with 36 improper input validation bugs. Of the six critical issues, five are memory corruption bugs and one is a use-after-free. Such flaws in a browser can potentially be abused through malicious web pages, which is why critical memory bugs in Chrome are typically treated as high-priority fixes. Google did not publish CVE identifiers or detailed descriptions for the critical and high-severity issues in the information cited by SecurityWeek; the only specific example mentioned is a high-severity use-after-free in Site Isolation.

The report also highlights how the bugs were found. Google's internal teams discovered 266 of the vulnerabilities, and SecurityWeek noted that external research credited in the release includes work by an Anthropic researcher assisted by Claude and by OpenAI's Codex Security. Google paid $50,000 across 24 vulnerabilities and has not disclosed amounts for 44 others. The highest reward listed, $10,000, went to Quyen Son of VinFast for the Site Isolation use-after-free.

Who is affected

All users of Chrome on Windows, macOS and Linux running versions earlier than Chrome 156 are affected. Other Chromium-based browsers typically pick up upstream fixes in their own subsequent releases, so organizations using those browsers should watch for vendor updates.

What to do

Users should check for updates through the browser's settings and relaunch Chrome to finish installing version 156. Enterprise administrators should push the update through their management tools and verify that endpoints are no longer running older builds, given the number of critical and high-severity memory safety fixes included.