‹ All news

AlertHigh· Updated on

Google fixes 353 security flaws in Chrome 156, six of them critical

Google has released Chrome 156 with 353 security fixes, six of them critical, that could allow code execution through a crafted web page. Chrome on Windows, Mac and Linux before version 156.0.8078.47 is affected, and NVD also lists Android- and iOS-specific components.

What happened

According to Google's advisory, Chrome 156 was promoted to the stable channel for Windows, Mac and Linux on Tuesday, 20 October 2026, with 353 security fixes. The fixed versions are 156.0.8078.47 on Linux and 156.0.8078.47/.48 on Windows and Mac. The release will roll out gradually over the coming days or weeks, and Google will keep technical details restricted until most users have updated.

Most of the flaws involve memory corruption, use-after-free bugs and improper input validation. According to the NVD entries, a remote attacker could execute arbitrary code inside the browser sandbox if a victim opens a crafted HTML page.

The most serious flaws

Google rates six vulnerabilities as critical. They were found by Google itself, by Anthropic researchers assisted by the company's Claude model, and by OpenAI's Codex Security tool:

Among the issues Google rates as high severity are three in V8, the JavaScript engine (CVE-2026-113044, CVE-2026-113193 and CVE-2026-113222), numerous flaws in the ANGLE graphics layer, and CVE-2026-113101 in SiteIsolation, which earned a USD 10,000 bounty. NVD scores every published entry at CVSS 8.8, but Google rates several of them as low severity, such as CVE-2026-112994 and CVE-2026-113156. Where the two disagree, the vendor's assessment takes precedence.

Who is affected and exploitation status

All Google Chrome installations older than version 156.0.8078.47 are affected. Several NVD entries refer to components specific to Android (Omnibox, CustomTabs, Toolbar) and iOS (iOSWeb). Google's advisory covers desktop only and does not list fixed mobile versions.

None of these vulnerabilities is in CISA's KEV catalogue, and Google's advisory does not mention active exploitation. Even so, the number and severity of the flaws, combined with an easy attack vector (simply visiting a website), make prompt updating advisable.

What to do

We recommend updating Chrome on every device across the organisation without waiting for the automatic rollout.

Fixed identifiers

Besides the six critical flaws, Chrome 156 fixes the vulnerabilities with the following identifiers:

Sources

Affected technologies

Google ChromeGoogle Chrome for AndroidGoogle Chrome for iOS

Vulnerabilities (297)

CVESeverityActive exploitationPublishedNVD status
CVE-2026-112994High (8.8)—10/20/2026Received
CVE-2026-112996High (8.8)—10/20/2026Received
CVE-2026-112998High (8.8)—10/20/2026Received
CVE-2026-113013High (8.8)—10/20/2026Received
CVE-2026-113017High (8.8)—10/20/2026Received
CVE-2026-113021High (8.8)—10/20/2026Received
CVE-2026-113024High (8.8)—10/20/2026Received
CVE-2026-113025High (8.8)—10/20/2026Received
CVE-2026-113029High (8.8)—10/20/2026Received
CVE-2026-113036High (8.8)—10/20/2026Received
CVE-2026-113039High (8.8)—10/20/2026Received
CVE-2026-113046High (8.8)—10/20/2026Received
CVE-2026-113048High (8.8)—10/20/2026Received
CVE-2026-113061High (8.8)—10/20/2026Received
CVE-2026-113063High (8.8)—10/20/2026Received
CVE-2026-113067High (8.8)—10/20/2026Received
CVE-2026-113074High (8.8)—10/20/2026Received
CVE-2026-113080High (8.8)—10/20/2026Received
CVE-2026-113083High (8.8)—10/20/2026Received
CVE-2026-113085High (8.8)—10/20/2026Received
CVE-2026-113088High (8.8)—10/20/2026Received
CVE-2026-113107High (8.8)—10/20/2026Received
CVE-2026-113121High (8.8)—10/20/2026Received
CVE-2026-113125High (8.8)—10/20/2026Received
CVE-2026-113130High (8.8)—10/20/2026Received
CVE-2026-113132High (8.8)—10/20/2026Received
CVE-2026-113140High (8.8)—10/20/2026Received
CVE-2026-113145High (8.8)—10/20/2026Received
CVE-2026-113152High (8.8)—10/20/2026Received
CVE-2026-113156High (8.8)—10/20/2026Received
CVE-2026-113167High (8.8)—10/20/2026Received
CVE-2026-113173High (8.8)—10/20/2026Received
CVE-2026-113180High (8.8)—10/20/2026Received
CVE-2026-113182High (8.8)—10/20/2026Received
CVE-2026-113184High (8.8)—10/20/2026Received
CVE-2026-113226High (8.8)—10/20/2026Received
CVE-2026-113227High (8.8)—10/20/2026Received
CVE-2026-113241High (8.8)—10/20/2026Received
CVE-2026-113244High (8.8)—10/20/2026Received
CVE-2026-113245High (8.8)—10/20/2026Received
CVE-2026-113247High (8.8)—10/20/2026Received
CVE-2026-113248High (8.8)—10/20/2026Received
CVE-2026-113254High (8.8)—10/20/2026Received
CVE-2026-113260High (8.8)—10/20/2026Received
CVE-2026-113268High (8.8)—10/20/2026Received
CVE-2026-113269High (8.8)—10/20/2026Received
CVE-2026-113274High (8.8)—10/20/2026Received
CVE-2026-113286High (8.8)—10/20/2026Received
CVE-2026-113287High (8.8)—10/20/2026Received
CVE-2026-113288High (8.8)—10/20/2026Received
CVE-2026-113291High (8.8)—10/20/2026Received
CVE-2026-113292High (8.8)—10/20/2026Received
CVE-2026-113294High (8.8)—10/20/2026Received
CVE-2026-113299High (8.8)—10/20/2026Received
CVE-2026-113306High (8.8)—10/20/2026Received
CVE-2026-113313High (8.8)—10/20/2026Received
CVE-2026-113314High (8.8)—10/20/2026Received
CVE-2026-113330High (8.8)—10/20/2026Received
CVE-2026-113331High (8.8)—10/20/2026Received
CVE-2026-112993High (8.8)—10/20/2026Received
CVE-2026-112995High (8.8)—10/20/2026Received
CVE-2026-112997High (8.8)—10/20/2026Received
CVE-2026-112999High (8.8)—10/20/2026Received
CVE-2026-113000High (8.8)—10/20/2026Received
CVE-2026-113001High (8.8)—10/20/2026Received
CVE-2026-113003High (8.8)—10/20/2026Received
CVE-2026-113004High (8.8)—10/20/2026Received
CVE-2026-113005High (8.8)—10/20/2026Received
CVE-2026-113006High (8.8)—10/20/2026Received
CVE-2026-113008High (8.8)—10/20/2026Received
CVE-2026-113009High (8.8)—10/20/2026Received
CVE-2026-113011High (8.8)—10/20/2026Received
CVE-2026-113012High (8.8)—10/20/2026Received
CVE-2026-113015High (8.8)—10/20/2026Received
CVE-2026-113016High (8.8)—10/20/2026Received
CVE-2026-113018High (8.8)—10/20/2026Received
CVE-2026-113019High (8.8)—10/20/2026Received
CVE-2026-113022High (8.8)—10/20/2026Received
CVE-2026-113027High (8.8)—10/20/2026Received
CVE-2026-113028High (8.8)—10/20/2026Received
CVE-2026-113031High (8.8)—10/20/2026Received
CVE-2026-113032High (8.8)—10/20/2026Received
CVE-2026-113033High (8.8)—10/20/2026Received
CVE-2026-113034High (8.8)—10/20/2026Received
CVE-2026-113037High (8.8)—10/20/2026Received
CVE-2026-113040High (8.8)—10/20/2026Received
CVE-2026-113041High (8.8)—10/20/2026Received
CVE-2026-113042High (8.8)—10/20/2026Received
CVE-2026-113043High (8.8)—10/20/2026Received
CVE-2026-113044High (8.8)—10/20/2026Received
CVE-2026-113049High (8.8)—10/20/2026Received
CVE-2026-113052High (8.8)—10/20/2026Received
CVE-2026-113053High (8.8)—10/20/2026Received
CVE-2026-113055High (8.8)—10/20/2026Received
CVE-2026-113058High (8.8)—10/20/2026Received
CVE-2026-113059High (8.8)—10/20/2026Received
CVE-2026-113060High (8.8)—10/20/2026Received
CVE-2026-113062High (8.8)—10/20/2026Received
CVE-2026-113064High (8.8)—10/20/2026Received
CVE-2026-113065High (8.8)—10/20/2026Received
CVE-2026-113068High (8.8)—10/20/2026Received
CVE-2026-113069High (8.8)—10/20/2026Received
CVE-2026-113071High (8.8)—10/20/2026Received
CVE-2026-113073High (8.8)—10/20/2026Received
CVE-2026-113075High (8.8)—10/20/2026Received
CVE-2026-113076High (8.8)—10/20/2026Received
CVE-2026-113079High (8.8)—10/20/2026Received
CVE-2026-113081High (8.8)—10/20/2026Received
CVE-2026-113086High (8.8)—10/20/2026Received
CVE-2026-113087High (8.8)—10/20/2026Received
CVE-2026-113090High (8.8)—10/20/2026Received
CVE-2026-113091High (8.8)—10/20/2026Received
CVE-2026-113092High (8.8)—10/20/2026Received
CVE-2026-113093High (8.8)—10/20/2026Received
CVE-2026-113094High (8.8)—10/20/2026Received
CVE-2026-113095High (8.8)—10/20/2026Received
CVE-2026-113096High (8.8)—10/20/2026Received
CVE-2026-113097High (8.8)—10/20/2026Received
CVE-2026-113099High (8.8)—10/20/2026Received
CVE-2026-113100High (8.8)—10/20/2026Received
CVE-2026-113101High (8.8)—10/20/2026Received
CVE-2026-113103High (8.8)—10/20/2026Received
CVE-2026-113104High (8.8)—10/20/2026Received
CVE-2026-113105High (8.8)—10/20/2026Received
CVE-2026-113106High (8.8)—10/20/2026Received
CVE-2026-113108High (8.8)—10/20/2026Received
CVE-2026-113109High (8.8)—10/20/2026Received
CVE-2026-113110High (8.8)—10/20/2026Received
CVE-2026-113111High (8.8)—10/20/2026Received
CVE-2026-113112High (8.8)—10/20/2026Received
CVE-2026-113113High (8.8)—10/20/2026Received
CVE-2026-113114High (8.8)—10/20/2026Received
CVE-2026-113115High (8.8)—10/20/2026Received
CVE-2026-113117High (8.8)—10/20/2026Received
CVE-2026-113118High (8.8)—10/20/2026Received
CVE-2026-113119High (8.8)—10/20/2026Received
CVE-2026-113120High (8.8)—10/20/2026Received
CVE-2026-113123High (8.8)—10/20/2026Received
CVE-2026-113124High (8.8)—10/20/2026Received
CVE-2026-113127High (8.8)—10/20/2026Received
CVE-2026-113131High (8.8)—10/20/2026Received
CVE-2026-113133High (8.8)—10/20/2026Received
CVE-2026-113134High (8.8)—10/20/2026Received
CVE-2026-113135High (8.8)—10/20/2026Received
CVE-2026-113136High (8.8)—10/20/2026Received
CVE-2026-113141High (8.8)—10/20/2026Received
CVE-2026-113146High (8.8)—10/20/2026Received
CVE-2026-113147High (8.8)—10/20/2026Received
CVE-2026-113148High (8.8)—10/20/2026Received
CVE-2026-113149High (8.8)—10/20/2026Received
CVE-2026-113150High (8.8)—10/20/2026Received
CVE-2026-113153High (8.8)—10/20/2026Received
CVE-2026-113154High (8.8)—10/20/2026Received
CVE-2026-113155High (8.8)—10/20/2026Received
CVE-2026-113158High (8.8)—10/20/2026Received
CVE-2026-113160High (8.8)—10/20/2026Received
CVE-2026-113161High (8.8)—10/20/2026Received
CVE-2026-113162High (8.8)—10/20/2026Received
CVE-2026-113163High (8.8)—10/20/2026Received
CVE-2026-113164High (8.8)—10/20/2026Received
CVE-2026-113165High (8.8)—10/20/2026Received
CVE-2026-113166High (8.8)—10/20/2026Received
CVE-2026-113168High (8.8)—10/20/2026Received
CVE-2026-113170High (8.8)—10/20/2026Received
CVE-2026-113172High (8.8)—10/20/2026Received
CVE-2026-113174High (8.8)—10/20/2026Received
CVE-2026-113175High (8.8)—10/20/2026Received
CVE-2026-113176High (8.8)—10/20/2026Received
CVE-2026-113177High (8.8)—10/20/2026Received
CVE-2026-113179High (8.8)—10/20/2026Received
CVE-2026-113181High (8.8)—10/20/2026Received
CVE-2026-113183High (8.8)—10/20/2026Received
CVE-2026-113185High (8.8)—10/20/2026Received
CVE-2026-113187High (8.8)—10/20/2026Received
CVE-2026-113188High (8.8)—10/20/2026Received
CVE-2026-113190High (8.8)—10/20/2026Received
CVE-2026-113191High (8.8)—10/20/2026Received
CVE-2026-113192High (8.8)—10/20/2026Received
CVE-2026-113194High (8.8)—10/20/2026Received
CVE-2026-113195High (8.8)—10/20/2026Received
CVE-2026-113197High (8.8)—10/20/2026Received
CVE-2026-113198High (8.8)—10/20/2026Received
CVE-2026-113200High (8.8)—10/20/2026Received
CVE-2026-113202High (8.8)—10/20/2026Received
CVE-2026-113203High (8.8)—10/20/2026Received
CVE-2026-113204High (8.8)—10/20/2026Received
CVE-2026-113205High (8.8)—10/20/2026Received
CVE-2026-113206High (8.8)—10/20/2026Received
CVE-2026-113207High (8.8)—10/20/2026Received
CVE-2026-113208High (8.8)—10/20/2026Received
CVE-2026-113210High (8.8)—10/20/2026Received
CVE-2026-113213High (8.8)—10/20/2026Received
CVE-2026-113214High (8.8)—10/20/2026Received
CVE-2026-113215High (8.8)—10/20/2026Received
CVE-2026-113216High (8.8)—10/20/2026Received
CVE-2026-113217High (8.8)—10/20/2026Received
CVE-2026-113218High (8.8)—10/20/2026Received
CVE-2026-113219High (8.8)—10/20/2026Received
CVE-2026-113220High (8.8)—10/20/2026Received
CVE-2026-113221High (8.8)—10/20/2026Received
CVE-2026-113228High (8.8)—10/20/2026Received
CVE-2026-113229High (8.8)—10/20/2026Received
CVE-2026-113230High (8.8)—10/20/2026Received
CVE-2026-113231High (8.8)—10/20/2026Received
CVE-2026-113232High (8.8)—10/20/2026Received
CVE-2026-113233High (8.8)—10/20/2026Received
CVE-2026-113234High (8.8)—10/20/2026Received
CVE-2026-113236High (8.8)—10/20/2026Received
CVE-2026-113238High (8.8)—10/20/2026Received
CVE-2026-113239High (8.8)—10/20/2026Received
CVE-2026-113240High (8.8)—10/20/2026Received
CVE-2026-113242High (8.8)—10/20/2026Received
CVE-2026-113243High (8.8)—10/20/2026Received
CVE-2026-113249High (8.8)—10/20/2026Received
CVE-2026-113250High (8.8)—10/20/2026Received
CVE-2026-113251High (8.8)—10/20/2026Received
CVE-2026-113253High (8.8)—10/20/2026Received
CVE-2026-113255High (8.8)—10/20/2026Received
CVE-2026-113256High (8.8)—10/20/2026Received
CVE-2026-113257High (8.8)—10/20/2026Received
CVE-2026-113258High (8.8)—10/20/2026Received
CVE-2026-113259High (8.8)—10/20/2026Received
CVE-2026-113262High (8.8)—10/20/2026Received
CVE-2026-113265High (8.8)—10/20/2026Received
CVE-2026-113266High (8.8)—10/20/2026Received
CVE-2026-113267High (8.8)—10/20/2026Received
CVE-2026-113271High (8.8)—10/20/2026Received
CVE-2026-113272High (8.8)—10/20/2026Received
CVE-2026-113273High (8.8)—10/20/2026Received
CVE-2026-113275High (8.8)—10/20/2026Received
CVE-2026-113276High (8.8)—10/20/2026Received
CVE-2026-113278High (8.8)—10/20/2026Received
CVE-2026-113279High (8.8)—10/20/2026Received
CVE-2026-113280High (8.8)—10/20/2026Received
CVE-2026-113281High (8.8)—10/20/2026Received
CVE-2026-113282High (8.8)—10/20/2026Received
CVE-2026-113284High (8.8)—10/20/2026Received
CVE-2026-113285High (8.8)—10/20/2026Received
CVE-2026-113289High (8.8)—10/20/2026Received
CVE-2026-113290High (8.8)—10/20/2026Received
CVE-2026-113293High (8.8)—10/20/2026Received
CVE-2026-113298High (8.8)—10/20/2026Received
CVE-2026-113301High (8.8)—10/20/2026Received
CVE-2026-113302High (8.8)—10/20/2026Received
CVE-2026-113303High (8.8)—10/20/2026Received
CVE-2026-113305High (8.8)—10/20/2026Received
CVE-2026-113307High (8.8)—10/20/2026Received
CVE-2026-113308High (8.8)—10/20/2026Received
CVE-2026-113311High (8.8)—10/20/2026Received
CVE-2026-113312High (8.8)—10/20/2026Received
CVE-2026-113315High (8.8)—10/20/2026Received
CVE-2026-113316High (8.8)—10/20/2026Received
CVE-2026-113317High (8.8)—10/20/2026Received
CVE-2026-113318High (8.8)—10/20/2026Received
CVE-2026-113319High (8.8)—10/20/2026Received
CVE-2026-113320High (8.8)—10/20/2026Received
CVE-2026-113321High (8.8)—10/20/2026Received
CVE-2026-113323High (8.8)—10/20/2026Received
CVE-2026-113324High (8.8)—10/20/2026Received
CVE-2026-113327High (8.8)—10/20/2026Received
CVE-2026-113332High (8.8)—10/20/2026Received
CVE-2026-113334High (8.8)—10/20/2026Received
CVE-2026-113335High (8.8)—10/20/2026Received
CVE-2026-113337High (8.8)—10/20/2026Received
CVE-2026-113338High (8.8)—10/20/2026Received
CVE-2026-113339High (8.8)—10/20/2026Received
CVE-2026-113343High (8.8)—10/20/2026Received
CVE-2026-113344High (8.8)—10/20/2026Received
CVE-2026-112992Critical (9.6)—10/20/2026Received
CVE-2026-113007Critical (9.6)—10/20/2026Received
CVE-2026-113014Critical (9.6)—10/20/2026Received
CVE-2026-113020Critical (9.6)—10/20/2026Received
CVE-2026-113023Critical (9.6)—10/20/2026Received
CVE-2026-113056Critical (9.6)—10/20/2026Received
CVE-2026-113072Critical (9.6)—10/20/2026Received
CVE-2026-113078Critical (9.6)—10/20/2026Received
CVE-2026-113084Critical (9.6)—10/20/2026Received
CVE-2026-113089Critical (9.6)—10/20/2026Received
CVE-2026-113116Critical (9.6)—10/20/2026Received
CVE-2026-113126Critical (9.6)—10/20/2026Received
CVE-2026-113138Critical (9.6)—10/20/2026Received
CVE-2026-113169Critical (9.6)—10/20/2026Received
CVE-2026-113171Critical (9.6)—10/20/2026Received
CVE-2026-113186Critical (9.6)—10/20/2026Received
CVE-2026-113189Critical (9.6)—10/20/2026Received
CVE-2026-113211Critical (9.6)—10/20/2026Received
CVE-2026-113222Critical (9.6)—10/20/2026Received
CVE-2026-113235Critical (9.6)—10/20/2026Received
CVE-2026-113252Critical (9.6)—10/20/2026Received
CVE-2026-113261Critical (9.6)—10/20/2026Received
CVE-2026-113263Critical (9.6)—10/20/2026Received
CVE-2026-113270Critical (9.6)—10/20/2026Received
CVE-2026-113283Critical (9.6)—10/20/2026Received
CVE-2026-113300Critical (9.6)—10/20/2026Received
CVE-2026-113328Critical (9.6)—10/20/2026Received
CVE-2026-113336Critical (9.6)—10/20/2026Received
CVE-2026-113342Critical (9.6)—10/20/2026Received

Written automatically from NVD, CISA KEV and vendor advisory data. Always check affected versions and patches in the vendor's official advisory before acting.