Google Chrome 156 fixes 353 vulnerabilities, including six critical memory corruption and use-after-free flaws
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 21/10/2026 12:15; os links antigos trazem para cá.
Fontes: securityweek.com ↗ gbhackers.com ↗
Google promoted Chrome 156 to the stable channel for Windows, macOS and Linux on October 20, 2026, fixing 353 vulnerabilities, six of them critical (gbhackers.com, securityweek.com). The critical flaws are five memory corruption bugs and one use-after-free in Accessibility. Most of the 353 are memory safety issues: 163 memory corruption bugs, 125 use-after-free and 17 out-of-bounds reads, plus 36 improper input validation flaws (securityweek.com). The release credits AI-assisted research, including Anthropic researcher Xinyang Ge working with Claude and OpenAI Codex Security (gbhackers.com, securityweek.com). Neither source reports exploitation in the wild. gbhackers.com adds that the announcement gives no CVSS scores and no confirmed RCE or sandbox escape chains. The two sources give different counts for the high and medium severity tiers (see Conflicting Reports).
Detalhes técnicos
- Fixed builds: 156.0.8078.47 (Linux) and 156.0.8078.47/.48 (Windows and macOS) (gbhackers.com, securityweek.com).
- Critical CVEs named: CVE-2026-113279 (Accessibility), CVE-2026-113303 (WebRTC) and CVE-2026-113271 (Accessibility use-after-free). Only these three of the six critical CVEs are named (gbhackers.com).
- High-severity issues affect ANGLE, V8, GPU, Canvas, Navigation, FileSystem, WebRTC, Site Isolation, Password management, Privacy, ServiceWorkers, PDF and the installer (gbhackers.com).
- Bounties: $10,000 to Quyen Son (VinFast) for CVE-2026-113101, a Site Isolation use-after-free, the highest reward. $3,000 for CVE-2026-113097, a FileSystem use-after-free (gbhackers.com, securityweek.com).
- No bounty is paid for 285 vulnerabilities, which were found by Google (266), Xinyang Ge (Anthropic, assisted by Claude) or OpenAI Codex Security. Google paid $50,000 for 24 flaws, and the amounts for another 44 were not disclosed, so the total will likely be higher (securityweek.com).
- Google may restrict bug details until most users have updated, or while third-party libraries remain unpatched (gbhackers.com).
Remediação
- Update Chrome to 156.0.8078.47 or later (156.0.8078.47/.48 on Windows and macOS) and verify that managed fleets have received it (gbhackers.com, securityweek.com).
- Restart browsers so the update takes effect, and prioritize enterprise rollout given the number of critical and high-severity fixes (gbhackers.com).
Relatos divergentes
- Severity breakdown: gbhackers.com reports 6 critical, 68 high, 190 medium and 89 low. securityweek.com reports 6 critical, 61 high, 197 medium and 89 low. Both add up to 353 and agree on the critical and low counts. No source resolves the difference.
Linha do tempo
-
Google releases Chrome 156 with fixes for 353 vulnerabilities, six rated critical, mostly memory safety bugs
ler a análise desta fonte ocultar
Google promoted Chrome 156 to the stable channel on Tuesday with patches for 353 vulnerabilities. Most are memory safety flaws: 163 memory corruption bugs, 125 use-after-free issues and 17 out-of-bounds reads. A further 36 are improper input validation issues. The release fixes six critical-severity flaws (five memory corruption defects and one use-after-free), plus 61 high, 197 medium and 89 low-severity issues. Google does not report exploitation in the wild for any of them.
Technical Details
- Severity breakdown: 6 critical, 61 high, 197 medium, 89 low.
- No bug bounty is paid for 285 vulnerabilities, which were found by Google (266), Xinyang Ge (Anthropic, assisted by Claude) or OpenAI Codex Security.
- Google paid $50,000 for 24 of the flaws, but the amounts for another 44 were not disclosed, so the total will likely be higher.
- Quyen Son (VinFast) received the highest reward, $10,000, for a high-severity use-after-free in Site Isolation.
Remediation
Update Chrome to 156.0.8078.47/.48 on Windows and macOS, or 156.0.8078.47 on Linux. The release is rolling out now.
-
Google Chrome 156 patches 353 vulnerabilities, including six critical memory corruption and use-after-free flaws
ler a análise desta fonte ocultar
Google released Chrome 156 to the stable channel for Windows, macOS and Linux on October 20, 2026, fixing 353 vulnerabilities: 6 critical, 68 high, 190 medium and 89 low. The critical flaws include five memory corruption bugs and one use-after-free in Accessibility. The release also credits AI-assisted research, including Anthropic researcher Xinyang Ge working with Claude and OpenAI Codex Security ("kylebot"). The announcement does not say whether any of the flaws are exploited in the wild, and it gives no CVSS scores or confirmed RCE or sandbox escape chains.
Technical Details
- Fixed builds: 156.0.8078.47 (Linux) and 156.0.8078.47/.48 (Windows and macOS). Rollout continues over the coming days and weeks.
- Critical: CVE-2026-113279 (Accessibility), CVE-2026-113303 (WebRTC) and CVE-2026-113271 (Accessibility use-after-free). The article names only these three of the six critical CVEs.
- High-severity issues affect ANGLE, V8, GPU, Canvas, Navigation, FileSystem, WebRTC, Site Isolation, Password management, Privacy, ServiceWorkers, PDF and the installer.
- Bounties: $10,000 to Quyen Son (VinFast) for CVE-2026-113101 (Site Isolation use-after-free) and $3,000 for CVE-2026-113097 (FileSystem use-after-free).
- Google may restrict bug details until most users have updated, or while third-party libraries remain unpatched.
Remediation
- Update Chrome to 156.0.8078.47 or later on all platforms and verify that managed fleets have received it.
- Restart browsers so the update takes effect, and prioritize enterprise rollout given the number of critical and high-severity fixes.