Chrome 156 fixes 353 flaws, six of them critical
Update Chrome to 156.0.8078.47 on Windows, macOS and Linux

Chrome 156 fixes 353 flaws, six of them critical

Google moved Chrome 156 to the stable channel on 20 October 2026 with 353 security fixes, six of them rated critical. Chrome 155 shipped 37 security fixes, so this release is roughly ten times the normal load.

What happened

Six critical memory-corruption bugs were closed in CSS, WebRTC, Skia, Paint and Accessibility. Two matter most on desktop: CVE-2026-113072, a memory corruption flaw in CSS that could let a crafted HTML page execute code outside the sandbox, and CVE-2026-113303, a memory corruption flaw in WebRTC that could execute code inside the sandbox.

Google has not reported exploitation in the wild and has not published technical detail, which is normal until most users have updated. Several of the worst flaws were found with AI-assisted tooling, according to the credit lines in the release.

Who is affected

Any Chrome desktop install older than 156.0.8078.47 on Windows, macOS or Linux.

  • Staff laptops and desktops running Chrome that is not centrally managed
  • Windows PCs where Chrome updates are blocked by a third-party patch tool or a stale policy
  • Microsoft Edge, Brave and other Chromium browsers, which follow the same upstream fixes on their own schedule
  • Android Chrome, where a separate critical Skia memory read was fixed in the same release

What to do now

Push Chrome 156 to every managed endpoint today, then confirm the version rather than assuming the auto-updater ran.

  • Check chrome://version and confirm 156.0.8078.47 or later on Windows and macOS, 156.0.8078.47 on Linux
  • On managed fleets, verify no browser policy is pinning an older version
  • Ask users to restart the browser, since the new build only takes effect after relaunch
  • Check Edge and other Chromium browsers for their matching update rather than waiting

What this means for South African businesses

Browser bugs are the cheapest route into an SME network: no firewall rule, no exposed service, just a staff member opening a link. Most South African SMEs patch Windows monthly but leave Chrome to update itself, which works until a machine sits offline for weeks or a policy blocks the updater. With six critical memory bugs in one drop, the risk sits with the handful of machines that quietly stayed behind.

Source: Chrome Releases, stable channel update for desktop, 20 October 2026.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

UpdraftCentral key theft: 99 fake plugin names used to backdoor WordPress sites
Stolen dashboard keys let an attacker install plugins that hide an Editor account from the admin list