Chrome 156 stable release patches 353 flaws including critical memory corruption

Google has promoted Chrome 156 to the stable channel for Windows, Mac, and Linux desktops. The release, version 156.0.8078.47 for Linux and 156.0.8078.47/.48 for Windows and Mac, includes 353 security fixes. According to the official advisory, these updates will roll out to users over the coming days and weeks. The Chrome team notes that access to specific bug details may remain restricted until a majority of users have updated.

How it unfolded

• On 2026-10-03, Google reported a critical memory corruption flaw in Skia, identified as CVE-2026-113341.
• Between 2026-10-05 and 2026-10-06, Xinyang Ge reported multiple critical memory corruption issues in Accessibility, CSS, and Paint components.
• On 2026-10-08, Xinyang Ge, assisted by Claude, reported a critical use-after-free vulnerability in Accessibility, CVE-2026-113271.

Who is affected

Desktop users on Windows, Mac, and Linux running Chrome versions prior to 156 are affected by the 353 fixes. ChromeOS devices are also impacted, with version 16836.19.0 rolling out to the stable channel. This ChromeOS update includes browser fixes such as critical use-after-free errors in Track and high-severity issues in PDF and Media handling. Additionally, it addresses third-party library vulnerabilities, including kernel memory corruption in mali_kbase and mali drivers.

Our take on the response

The inclusion of 353 fixes in a single stable release indicates a significant accumulation of resolved vulnerabilities. The presence of critical flaws in core rendering and accessibility components suggests that attackers could potentially exploit these to compromise user sessions. The restriction on bug details until widespread adoption is a standard mitigation tactic to reduce the window of exposure for zero-day exploits.

Who needs to act first

Managed service providers should prioritize updating internet-facing workstations and shared kiosks first, as these systems have the highest exposure to malicious web content. Teams usually begin by verifying that automatic update policies are enabled across the fleet. If manual deployment is required, test the update on a small subset of devices to ensure compatibility with existing enterprise extensions. Back up critical user profiles before rolling out the patch broadly. Monitor for any immediate stability issues post-update.

What to do and how to stay safe: Google Chrome

• Verify that all managed Chrome instances are set to receive stable channel updates automatically.
• Check for devices that have not connected to the internet in over 30 days and force a manual update check.
• Review ChromeOS device logs for any errors related to the mali_kbase or arc-keymaster fixes.
• Ensure that endpoint protection tools are updated to detect potential exploitation attempts of known CVEs.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the latest stable version of Chrome for desktop?

The latest stable version is Chrome 156.0.8078.47 for Linux and 156.0.8078.47/.48 for Windows and Mac.

Are there any critical vulnerabilities in this update?

Yes, the update includes critical fixes for memory corruption in Skia, Accessibility, CSS, Paint, and WebRTC.

Does this update affect ChromeOS devices?

Yes, ChromeOS version 16836.19.0 has rolled out to the stable channel with browser and third-party security fixes.