Organisations Urged to Update Chrome 156 to Mitigate Critical Memory Corruption Risks Across Platforms

Google has released a substantial security update for its Chrome browser, resolving 353 identified vulnerabilities including six rated as critical, according to reports from GBHackers and Cyber Security News. This release targets users on Windows, macOS and Linux operating systems, aiming to close significant security gaps before they can be widely exploited by attackers.

The update, announced on 20 October 2026, addresses flaws in graphics rendering, accessibility features, networking and browser interfaces. Google stated that the deployment process will continue over the coming days and weeks, ensuring gradual distribution to the global user base rather than an immediate simultaneous rollout for all devices.

What we know

Specific version numbers for the patched software are 156.0.8078.47 for Linux, while Windows and macOS users receive versions 156.0.8078.47 or 156.0.8078.48. The six critical vulnerabilities include five instances of memory corruption and one use-after-free error affecting the Accessibility component, identified as CVE-2026-113271.

Five of the critical issues involve memory corruption within Skia, Accessibility, CSS, Paint and WebRTC components. The remaining critical flaw is a use-after-free vulnerability in Accessibility. Google’s advisory does not disclose specific exploitation prerequisites or complete attack chains for these critical defects, leaving the exact threat landscape partially obscured.

Researcher Xinyang Ge from Anthropic, assisted by the AI tool Claude, reported the critical Accessibility use-after-free finding. The critical WebRTC flaw was identified by OpenAI Codex Security, known as kylebot. These credits highlight the growing role of artificial intelligence tools in assisting security researchers with browser vulnerability discovery.

Additional high-severity fixes cover ANGLE, V8, GPU processing and Site Isolation. Google awarded $10,000 to Quyen Son at VinFast for reporting CVE-2026-113101, a Site Isolation use-after-free vulnerability. A further $3,000 reward was issued for the FileSystem use-after-free issue, CVE-2026-113097, with other awards still pending determination.

This release follows earlier October patch rounds, including an update fixing 37 vulnerabilities as TechWire Beat reported on 20 October 2026. The cumulative effect of these updates indicates a busy month for browser security, with multiple critical memory-safety bugs addressed across consecutive releases to maintain platform integrity.

Defender's checklist

• Verify the installed Chrome version matches 156.0.8078.47 or higher on Linux systems.
• Confirm Windows and macOS installations have reached version 156.0.8078.47 or 156.0.8078.48.
• Restart the browser application immediately after the update completes to ensure fixes are active.
• Monitor internal logs for unusual browser behaviour that might indicate attempted exploitation of older flaws.

The background in plain language

Memory corruption occurs when software incorrectly manages memory allocation, potentially allowing attackers to execute arbitrary code. Use-after-free errors happen when a program accesses memory that has already been released, creating unpredictable behaviour. Input validation issues arise when software fails to properly check data before processing it. Teams usually prioritise patching these high-severity flaws quickly because they can lead to remote code execution. Check whether your organisation’s update policies automatically deploy these critical security fixes to all endpoints without manual intervention.

What to do and how to stay safe: Google Chrome

• Check your current Chrome version by navigating to the browser’s settings menu and comparing it against the patched versions listed in the advisory.
• Ensure automatic updates are enabled in your browser settings to receive security patches as soon as Google releases them to the stable channel.
• Restart your browser after any update is applied to guarantee that the new security code is fully loaded and active.
• Review your organisation’s patch management timeline to confirm that all managed devices have received the latest browser updates within an acceptable window.

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which operating systems are affected by this Chrome 156 security update?

The update addresses vulnerabilities for users on Windows, macOS and Linux platforms, according to Google’s release announcement.

How many critical vulnerabilities are fixed in this release?

Chrome version 156 fixes six critical security flaws, including five memory corruption issues and one use-after-free error.

Did AI tools help discover any of these vulnerabilities?

Yes, researcher Xinyang Ge used Claude to identify an Accessibility flaw, and OpenAI Codex Security reported a critical WebRTC vulnerability.