Organisations urged to patch Chrome 156 after Google fixes 353 flaws, including 163 memory corruption bugs

Google has promoted Chrome 156 to the stable channel, delivering patches for 353 security vulnerabilities. The update addresses a wide range of defects, with memory safety issues forming the largest category. This release follows earlier reporting by TechWire Beat on 21 October 2026, which urged organisations to update to mitigate critical memory corruption risks.

The browser refresh resolves six critical-severity vulnerabilities, comprising five memory corruption defects and one use-after-free bug. Additionally, the update addresses 61 high-severity, 197 medium-severity and 89 low-severity weaknesses. Google stated that it found no evidence that any of these vulnerabilities have been exploited in the wild.

What we know

Memory corruption bugs account for 163 of the resolved flaws, while use-after-free issues make up 125. Out-of-bounds reads contribute 17 to the total, and improper input validations account for 36. These categories represent the technical nature of the defects fixed in this release, according to SecurityWeek.

Google paid $50,000 in bug bounties for 24 of the vulnerabilities, though the final total is likely higher as amounts for 44 flaws were not disclosed. Quyen Son at VinFast received the highest single reward of $10,000 for a high-severity use-after-free issue in Site Isolation. No bounty rewards will be paid for 285 vulnerabilities, as they were found by Google, Xinyang Ge (Anthropic) or OpenAI Codex Security.

The latest Chrome iteration is now rolling out as versions 156.0.8078.47 and 156.0.8078.48 for Windows and macOS. Linux users receive version 156.0.8078.47. These version strings confirm the specific builds available for each operating system platform at the time of the stable channel promotion.

Defender's checklist

• Verify that all managed devices have automatically updated to Chrome 156.0.8078.47 or higher.
• Check for any devices that may be running older, unsupported versions of the browser.
• Review internal security logs for any unusual activity that might indicate prior exploitation.
• Ensure that automatic update policies are enabled to prevent future exposure to known flaws.

The background in plain language

Memory corruption occurs when software writes data to the wrong place in memory, potentially allowing attackers to take control. Use-after-free bugs happen when code accesses memory that has already been freed, which can lead to unpredictable behaviour. Teams usually prioritise patching these issues because they can allow remote code execution. Check whether your systems are configured to update automatically.

What to do and how to stay safe: Google Chrome

• Ensure automatic updates are enabled for Chrome to receive security patches promptly.
• Monitor network traffic for unusual patterns that might indicate exploitation attempts.
• Review application logs for signs of memory corruption or unexpected crashes.
• Educate users on the importance of keeping browsers updated to mitigate risk.

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Are any of the Chrome 156 vulnerabilities currently being exploited?

Google stated that it found no evidence of any of these vulnerabilities being exploited in the wild.

How many critical vulnerabilities were fixed in Chrome 156?

The update resolves six critical-severity vulnerabilities, including five memory corruption defects and one use-after-free bug.

What is the highest bug bounty paid for this release?

Quyen Son at VinFast received $10,000 for a high-severity use-after-free issue in Site Isolation.