Google moved Chrome 156 to the stable channel on Tuesday. The update carries 353 security fixes, and Google rates six of them critical, its highest severity.
Google does not say any of them are being exploited. The update only protects a PC once Chrome restarts, and plenty of people keep the same browser window open for weeks.
Chrome 156 fixes six critical bugs, but only after the browser restarts. Count how many of your laptops have not.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Chrome 156 fixes 353 security bugs, six rated critical
Chrome 156.0.8078.47 for Linux and 156.0.8078.47/.48 for Windows and Mac reached the stable channel on October 20, rolling out over the coming days and weeks. Chrome 156 for Android, version 156.0.8078.47, is arriving on Google Play over several days with the same security fixes.
The six critical bugs are memory corruption in Skia (CVE-2026-113341), Accessibility (CVE-2026-113279), CSS (CVE-2026-113072), Paint (CVE-2026-113280) and WebRTC (CVE-2026-113303), plus a use-after-free in Accessibility (CVE-2026-113271).
Every Chrome install waits on a browser restart
The CVE record for CVE-2026-113072 says a crafted HTML page could let a remote attacker run code outside Chrome’s sandbox. The others are described as code execution or memory reads inside the sandbox, which attackers usually pair with a second bug.
Google keeps bug details restricted until most users have updated, so there is little public detail for defenders to go on. The safe assumption is that the fix will be studied by attackers once it is public.
Force a relaunch and check the version number
- In managed fleets, set the RelaunchNotification and RelaunchNotificationPeriod policies so users are pushed to restart within a day or two.
- Check your endpoint tool or Chrome Browser Cloud Management for machines still below 156.0.8078.47.
- Watch for the matching releases of other Chromium-based browsers you allow, such as Microsoft Edge, and track them separately.
Forward this
Quick ask for everyone: Chrome has a security update with six critical fixes. Please close and reopen Chrome today, or click Relaunch when it asks. It takes a few seconds.
Details
- Fixed builds: 156.0.8078.47 (Linux), 156.0.8078.47/.48 (Windows, Mac), 156.0.8078.47 (Android).
- Critical: CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280, CVE-2026-113271, CVE-2026-113303.
- Exploitation: none reported by Google.
Hunt / verify
- Have users open
chrome://settings/help; it shows the running version and starts the update. - Report on browser versions from your EDR or management console and sort by last restart.
Source: Chrome Releases, October 20, 2026; CVE.org: CVE-2026-113072
Sources
- Chrome Releases: Stable Channel Update for Desktop, October 20, 2026
- Chrome Releases: Chrome for Android Update, October 20, 2026
- CVE.org: CVE-2026-113072
- Chrome Enterprise: RelaunchNotification policy
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
