Chrome 156 reaches Stable (156.0.8078.47/.48) with 353 security fixes, including six Critical memory bugs in Skia, Accessibility, CSS, Paint and WebRTC; one credited to an Anthropic researcher assisted by Claude and one to OpenAI Codex Security; no exploitation noted
Google's Chrome Releases blog says Chrome 156 was promoted to the Stable channel on 20 October 2026 (US Pacific time; early on 21 October in Perth) as 156.0.8078.47 for Linux and 156.0.8078.47/.48 for Windows and Mac, rolling out over the coming days and weeks. The update includes 353 security fixes: six Critical, 61 High, 197 Medium and 89 Low. The Critical bugs are CVE-2026-113341 (memory corruption in Skia, found by Google), CVE-2026-113279 (memory corruption in Accessibility), CVE-2026-113072 (memory corruption in CSS) and CVE-2026-113280 (memory corruption in Paint), all three reported by Xinyang Ge; CVE-2026-113271 (use-after-free in Accessibility, reported by Xinyang Ge of Anthropic, assisted by Claude, on 8 October); and CVE-2026-113303 (memory corruption in WebRTC, reported by OpenAI Codex Security on 15 October). High-rated fixes include use-after-free bugs in SiteIsolation (CVE-2026-113101, $10,000 reward), FileSystem, WebUI, Network, Passwords, SVG and V8, and a long run of ANGLE graphics bugs. Google does not say any of the flaws is exploited and does not publish CVSS scores; bug details stay restricted until most users have updated. Chrome 156.0.8078.47 for Android carries the same security fixes, Chrome 156.0.8078.46 shipped for iOS, and ChromeOS Stable moved to 16836.19.0 (browser 156.0.8078.42). This follows Chrome 155.0.8059.84 (15 October), which is a separate card. Primary: Chrome Releases (20 Oct 2026).
- Product
- Google Chrome desktop (Windows, Mac, Linux), Chrome for Android and iOS, ChromeOS
- Versions
- Fixed: Chrome 156.0.8078.47/.48 (Windows, Mac), 156.0.8078.47 (Linux, Android); ChromeOS 16836.19.0. Chrome 155 and earlier builds are affected.
- CVSS
- not published by Google; six flaws rated Critical by Chrome
- Exploited in Australia?
- unknown
- Patch to
- Update Chrome to 156.0.8078.47 or later and relaunch the browser (Android: 156.0.8078.47 from Google Play; ChromeOS: 16836.19.0). Managed fleets: confirm the update has applied and users have restarted, and watch for matching Edge, Brave, Opera and Electron releases built on Chromium 156.
Primary: Chrome Releases — Stable Channel Update for Desktop, Chrome 156.0.8078.47/.48 (20 Oct 2026) · Vendor: Chrome Releases — Chrome 156 for Android (156.0.8078.47), iOS (156.0.8078.46) and ChromeOS 16836.19.0 (20 Oct 2026) · CVE: CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280, CVE-2026-113271, CVE-2026-113303, CVE-2026-113101