Chrome 156 update addresses security flaws

Chrome 156 has been available for several days on Windows, macOS, and Linux. This version fixes 353 security vulnerabilities, including six classified as critical. Several reports are credited to AI tools. Google is rolling out the update gradually over several days or weeks, with versions 156.0.8078.47 (Linux) and 156.0.8078.47 or .48 (Windows and Mac). The company has not mentioned any active exploitation of these vulnerabilities.

Critical flaws affect core browser functions

Six critical vulnerabilities, including two reported using AI tools, affect Skia (the library that draws graphical elements), Accessibility (assistance functions), CSS (page formatting), Paint (display), and WebRTC (audio and video calls in the browser). Five are classified as "memory corruption," when a program reads or modifies a memory area it should not access. The sixth, in Accessibility, is a "use-after-free," meaning the program reuses a memory area it had already freed. This type of error creates a security risk, but Google does not describe any attack chain.

AI tools contribute to vulnerability discoveries

Regarding discoveries, Google itself reported the Skia vulnerability. Xinyang Ge is credited for four of the six critical vulnerabilities, but only the use-after-free in Accessibility mentions Anthropic and the assistance of Claude. The WebRTC vulnerability, reported on October 15, is credited to OpenAI Codex Security. Overall, five entries cite the help of Claude and four are attributed to Codex Security.

Many fixes come from older reports

Already, with Chrome 151, Google had deployed 370 fixes. Major versions of Chrome do not only fix vulnerabilities found just before its release. They group those that accumulate over months, or even several years. For Chrome 151, the reports mainly dated back to March-June 2026. For this latest version, we find a similar pattern. Most of the reports date back to 2026, but some are much older, as far back as 2018. Particularly sensitive vulnerabilities affect notably ANGLE, the JavaScript V8 engine, GPU, Network, and FileSystem.

Bug bounty rewards highlight contributions

Google pays 10,000 dollars for a use-after-free in SiteIsolation (the mechanism that isolates each site in a separate process), reported by Quyen Son (VinFast). This highlights the role of external researchers and the company's ongoing efforts to secure its browser through financial incentives and collaboration with the broader security community.