Chrome: stable update fixes 353 security flaws incl. critical memory corruption (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280)
Severity: critical · Patch status: patched · Since 2026-10-20 · CVE-2026-112992, CVE-2026-112993, CVE-2026-112994, CVE-2026-112995, CVE-2026-112996, CVE-2026-112997, CVE-2026-112998, CVE-2026-112999, CVE-2026-113000, CVE-2026-113001, CVE-2026-113002, CVE-2026-113003, CVE-2026-113004, CVE-2026-113005, CVE-2026-113006, CVE-2026-113007, CVE-2026-113008, CVE-2026-113009, CVE-2026-113010, CVE-2026-113011
On 2026-10-20 Google promoted Chrome 156 to the stable channel for Windows, Mac and Linux, rolling out over coming days/weeks. Versions 156.0.8078.47 (Linux) and 156.0.8078.47/.48 (Windows/Mac) contain 353 security fixes, including several critical memory corruption vulnerabilities in Skia, Accessibility, and CSS (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280), reported by Google and Xinyang Ge in early October 2026. Bug details and links are restricted until a majority of users are updated. No in-the-wild exploitation is mentioned. All users of Chrome on desktop platforms are affected until updated; the fix is delivered in the 156 stable release.
What to do
- Update Chrome to 156.0.8078.47/.48 or later on all managed Windows, Mac and Linux endpoints as soon as the rollout reaches your channel
- Force browser auto-update or push the update via enterprise policy (Update policies / MDM) and verify versions in your fleet
- If you manage Chromium-based browsers (Edge, Brave, etc.), track their rebuilds of the same underlying fixes and patch accordingly
- Restrict browsing of untrusted content via other controls until fleet updates complete
Fixed versions
- 156.0.8078.47 (Linux)
- 156.0.8078.47/.48 (Windows/Mac)
Sources
All live incidents on Threat Watch