Chrome 156 Security Update Fixes 353 Bugs: Windows Build 156.0.8078.47/.48

What Google shipped​

Google promoted Chrome 156 to Stable on October 20, 2026. SecurityOnline reported that it went out with 353 security fixes. PiunikaWeb, which first drew attention to the number, said the release addresses 353 issues, making it a huge release compared to the previous update that brought a mere 10 security fixes.

The builds to look for:

BrowserHow's build check matches the desktop numbers. It reports that the Linux build is listed as 156.0.8078.47. Windows and Mac are listed as 156.0.8078.47 or 156.0.8078.48. Browser Calendar lists Android Stable at 156.0.8078.47 as of October 20, and iOS at 156.0.8078.46. Google's Android notice says the update reaches Google Play over the next few days and carries the same security fixes as the desktop release unless stated otherwise.

The desktop rollout is staged. Google says the update arrives over days or weeks, so if your PC isn't offered it today, nothing is wrong. A limited Stable rollout of 156.0.8078.35/.36 had already reached a small percentage of Windows and Mac users on October 14. The October 20 push is the broad release.

Section summary: If you're on Windows, you want 156.0.8078.47 or .48. Android gets the same fixes through the Play Store, and the desktop rollout is gradual.

The six Critical bugs​

Google's desktop release notice lists six Critical vulnerabilities. Five are memory corruption bugs and one is a use-after-free:

• CVE-2026-113341: memory corruption in Skia, Chrome's graphics library, found internally by Google
• CVE-2026-113279: memory corruption in Accessibility
• CVE-2026-113072: memory corruption in CSS
• CVE-2026-113280: memory corruption in Paint
• CVE-2026-113271: use-after-free in Accessibility, credited to Xinyang Ge of Anthropic with help from Claude
• CVE-2026-113303: memory corruption in WebRTC, credited to OpenAI Codex Security

Xinyang Ge is also credited with the other Accessibility, CSS and Paint findings. SecurityOnline added CVSS scores. The highest is 9.6 (Critical · CVSSv3) — CVE-2026-113072, the CSS bug. Four others score 8.8, and CVE-2026-113341 was still awaiting analysis.

Two things are not happening. Google has not reported any of these bugs as exploited. Chrome Geek states that Google's post does not say any of these bugs are being exploited in the wild. SecurityOnline agrees that Google reports no exploitation in the wild. So these are not zero-days.

PiunikaWeb also wrote that these flaws could let an attacker run code without you clicking a thing. That goes further than Google's disclosure. Google has published component names and bug types, not exploit details. SecurityOnline's more careful wording is that in general, these bugs can let a malicious web page crash the browser or run code inside it. Chrome's sandbox exists so that code running "inside it" doesn't automatically mean control of your PC. Serious bugs, yes. Proven drive-by takeovers, not according to anything Google has published.

Section summary: Six Critical memory-safety bugs, one with a CVSS score of 9.6, no known exploitation, and only limited technical detail so far.

What the other 347 fixes look like​

Chrome Geek counted Google's full list: 6 are rated Critical, 61 High, 197 Medium and 89 Low. Most of the 353 are lower-severity fixes, but 67 rated High or Critical is still a lot to get onto your machines.

Google's list also shows bug bounty payouts. The largest visible award is $10,000 for CVE-2026-113101, a High-severity use-after-free in SiteIsolation reported by Quyen Son of VinFast. Site isolation is the feature that keeps different websites in separate processes, so a bug there is a good candidate for chaining with other flaws in an attack. Smaller listed awards include $3,000 for a FileSystem use-after-free, plus several $2,000 and $1,000 awards for bugs in CacheStorage, ANGLE, WebUI, Network, Passwords, SVG, Accessibility and V8.

Details are restricted for now. Google's standard notice, quoted by PiunikaWeb, says "access to bug details and links may be kept restricted until a majority of users are updated with a fix." Google says restrictions can also stay in place when a bug sits in a third-party library that other projects haven't patched yet.

Is 353 fixes unusual?​

It's big, but Chrome has shipped releases this size recently. In August, Malwarebytes reported that Chrome 152's Stable update includes 327 security fixes, ten of which address critical vulnerabilities. In early October, Malwarebytes covered another desktop update that includes 247 security fixes including four rated Critical. Very large patch counts have become a regular pattern for Chrome's major releases in 2026.

Sources disagree on what to compare Chrome 156 with. PiunikaWeb compares it with a 10-fix update, and Google's October 15 notice does list 10 security fixes. SecurityOnline instead says the Chrome 155 stable release fixed 37 security issues. Our reading is that the outlets are picking different Chrome 155 updates, not that one of them has the numbers wrong. The trend matters more than which baseline you choose.

The AI angle, and what it doesn't prove​

Two of the six Critical bugs are explicitly credited to AI-assisted research: Anthropic's Claude-assisted report and OpenAI Codex Security's report. Chrome Geek notes that several were reported by AI-assisted security research, including work credited to Anthropic and OpenAI Codex Security.

PiunikaWeb goes further. It says AI explains the size of the release and that most of the 353 bugs were found internally. Google's release record doesn't establish either claim. Google's notice also credits long-standing testing tools: AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer and AFL. Those have been finding Chrome bugs for years.

It's reasonable to suspect that AI-assisted code review is helping drive this year's huge patch counts. The Chrome 152 and 155 numbers fit that idea. But the public record shows AI credited on specific findings, not a measured share of the total. Treat "AI found most of these" as an opinion, not a finding. PiunikaWeb also connected the release to Google using Gemini against scam pages, and to a separate certificate action involving eMudhra. Neither appears in Chrome 156's release documentation, and neither changes what you need to do.

What Windows users should do​

1. Open Chrome and go to the About Chrome page from the Help section of the three-dot menu. Chrome checks for updates and downloads any build that has been offered to you.
2. Click Relaunch when it appears. A downloaded update does nothing until the browser restarts. If you keep 140 tabs open for three weeks at a time, this step is for you.
3. Check the version number. BrowserHow notes that you'll know it worked when your platform reports one of the Chrome 156 builds above. Updating doesn't touch your bookmarks or saved passwords.
4. If you don't see 156 yet, check again later. The rollout is staged.

What IT admins should do​

• Check your inventory against the build numbers. Anything reporting below 156.0.8078.47 on Windows hasn't received these fixes.
• Watch for machines that stay on old builds. Devices that rarely restart Chrome, kiosks, and VDI images are the usual stragglers. The download isn't the hard part. Getting the browser restarted is.
• Plan for Extended Stable. Browser Calendar notes that Extended Stable is an enterprise-focused channel that receives major updates every 8 weeks instead of 4 weeks. It still receives security patches and critical fixes. Those fleets get security fixes on their own schedule, so check Google's Extended Stable notices separately.
• Note the web platform changes. Chrome 156's platform release notes include removing fenced frames and stubbing the window.fence APIs. This mainly affects ad-tech code, but test internal web apps that depend on unusual APIs.
• Don't forget Edge. This is general industry knowledge, not something stated in these sources: Microsoft Edge runs on the same Chromium engine, so Chromium security fixes usually show up in Edge updates as well. Keep an eye on Microsoft's Edge security release notes rather than assuming Chrome and Edge patch on the same day.

Bottom line​

Chrome 156 fixes 353 security bugs, including six Critical memory-safety flaws, and none are known to be exploited. Big releases like this are becoming normal for Chrome, and AI-assisted research is showing up in the credits. But Google is keeping the details restricted for a reason. Once a patch is public, attackers can start comparing old and new code. Open About Chrome, relaunch, check for 156.0.8078.47 or .48, and if you manage a fleet, make sure every machine gets there.