Chrome 156 Ships 353 Security Fixes, Most of Them Memory Bugs

Past-week coverage · Original source published 2026-10-21.

Google announced Chrome 156 on the stable channel with patches for 353 vulnerabilities, according to SecurityWeek. Memory safety flaws made up most of the list: 163 memory corruption bugs, 125 use-after-free issues and 17 out-of-bounds reads. Another 36 were improper input validations.

Six of the fixed flaws were rated critical, five of them memory corruption defects and one a use-after-free bug. The release also resolves 61 high-severity issues, 197 medium-severity flaws and 89 low-severity weaknesses.

Google's advisory made no mention of any of these vulnerabilities being exploited in the wild. The company said it paid $50,000 in bug bounties covering 24 of the flaws, with amounts for 44 others not yet disclosed, and that no reward will be paid for 285 of them. Quyen Son at VinFast received the largest disclosed reward, $10,000, for a high-severity use-after-free issue in Site Isolation.

The update rolls out as versions 156.0.8078.47/.48 for Windows and macOS and 156.0.8078.47 for Linux.

Why it matters: Memory corruption and use-after-free bugs are the kind of flaw that can lead to crashes or, in the wrong hands, code execution inside the browser. A large batch like this is routine for Chrome, but it still means a lot of changed code.

What defenders should do: Confirm the browser build on managed endpoints matches the published versions, and keep the update cycle short rather than waiting for a maintenance window. Where Chrome updates are pinned or delayed by policy, check that the delay is deliberate and documented.