Chrome 156 Patch Closes 52 Flaws, Including Four Critical Bugs

Google has pushed a new Chrome update that patches 52 security vulnerabilities across the browser, addressing issues that touch file handling, page rendering, JavaScript, graphics, and media processing. The Stable channel moves to version 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux. According to Google’s release, the fixes include four critical vulnerabilities, 46 high-severity issues, and two medium-severity bugs. The company has not published exploit details or confirmed active exploitation.

What Google fixed

This release targets a broad set of defect classes: memory corruption, use-after-free, improper input validation, access-control and authorization gaps, and out-of-bounds writes. The critical flaws primarily affect file and display subsystems — FileSystem, FileAPI, Skia (graphics), and Layout — and were reported in October by researchers including Xinyang Ge of Anthropic with assistance from Claude. Google’s advisory lists individual CVE identifiers and affected components but omits exploit conditions for most entries, noting that some details will remain restricted until the majority of users update.

Critical Vulnerabilities:

Notable high-severity areas

High-severity fixes cover dozens of components, including the V8 JavaScript engine, ANGLE graphics translation, WebRTC, PDFium, WebAudio, and the browser’s core rendering and media paths. Examples in the advisory include an improper access control bug in V8 (CVE-2026-118318), a missing authorization issue in Video (CVE-2026-118333), and an out-of-bounds write in Editing (CVE-2026-118342). Google also called out several use-after-free and memory corruption bugs across Skia, Turbolev, and other subsystems.

High-Severity Vulnerabilities:

Medium-Severity Vulnerabilities:

Context and credits

This release follows prior Chrome updates earlier in the 156 cycle that addressed a large number of vulnerabilities, including a prior Chrome 156 release that fixed 353 flaws and another update that resolved 32 issues. Google’s advisory credits a mix of internal researchers and external contributors — including Mozilla, Anthropic, Ada Logics, OpenAI Codex Security, and independent reporters — and notes several reports identified AI assistance in discovery. The credits do not imply those tools independently verified every finding.

How users and admins should respond

Google recommends checking the installed Chrome build rather than relying on the browser’s major version number. Users can update by opening Chrome’s menu, selecting Help, then About Google Chrome, and relaunching after any available update installs. Linux users should update via their package manager. Administrators are advised to keep automatic updates enabled across managed Windows devices so critical fixes are applied promptly. Google also says some bug details will remain restricted until most users have updated, particularly where shared libraries could affect other projects.

Licensed under CC BY-ND 4.0 International