Google Releases Massive Chrome Security Update Fixing 353 Flaws, Including 6 Critical Vulnerabilities

Google released Chrome 156 for Windows, macOS, and Linux on October 20, 2026, fixing 353 security flaws, including six critical bugs across graphics, accessibility, rendering, and communication features.

Google says the release will reach users over the coming days and weeks. The patched versions are 156.0.8078.47 for Linux and 156.0.8078.47/.48 for Windows and Mac, according to the supplied release notice. Users should check their installed version and restart the browser after updating to ensure the fixes take effect.

According to Google’s security advisory, five critical vulnerabilities involve memory corruption. They are CVE-2026-113341 in Skia, CVE-2026-113279 in Accessibility, CVE-2026-113072 in CSS, CVE-2026-113280 in Paint, and CVE-2026-113303 in WebRTC. The sixth, CVE-2026-113271, is a use-after-free flaw in Accessibility.

Use-after-free bugs occur when software accesses released memory, creating security risks. However, the public notice does not detail how each critical flaw can be exploited or confirm a complete attack chain, so severity ratings alone do not prove full device compromise.

Chrome Security Update Fixing 353 Flaws

Google reported the Skia issue internally. Researcher Xinyang Ge reported memory corruption flaws in Accessibility, CSS, and Paint. The advisory credits Ge of Anthropic, assisted by Claude, for the Accessibility use-after-free finding. OpenAI Codex Security, identified as kylebot, reported the critical WebRTC vulnerability on October 15.

The credits show AI tools appearing alongside researchers in browser security work. However, the advisory doesn’t explain the extent of AI involvement in each finding, and the listed credits shouldn’t be read as evidence that every discovery was fully automated.

Beyond the critical issues, Chrome 156 fixes high-severity weaknesses in SiteIsolation, FileSystem, ANGLE, V8, GPU, Network, and other components.

The reported bug types include memory corruption, use-after-free, improper input validation, and out-of-bounds reads. Google awarded $10,000 for CVE-2026-113101, a SiteIsolation use-after-free flaw reported by Quyen Son at VinFast.

This release follows earlier October patch rounds covered by Cybersecuritynews.com, including a Chrome update that fixed 247 vulnerabilities and another that addressed 37 Chrome vulnerabilities. Those releases also included critical memory-safety bugs, making the latest update part of a busy month for browser patching.

Google’s announcement does not state that these six critical vulnerabilities are being exploited in active attacks. It also says access to bug details may remain restricted until most users receive fixes, or until affected third-party projects address shared issues. The available information therefore leaves important exploitation details undisclosed.

Users can follow Google’s update instructions by opening the browser menu, selecting Help, and choosing About Google Chrome. Chrome checks for available updates on that page. Select Relaunch when prompted.

Downloading a patch alone doesn’t complete the installation because Chrome applies the update when it restarts. For managed devices, administrators can use Chrome Enterprise policies to prompt or require browser restarts after pending updates.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.