Update Chrome Desktop and ChromeOS to Patch 353 Security Flaws

Google has promoted Chrome 156 to the stable channel for desktop operating systems, delivering a comprehensive update that addresses 353 security flaws. The release, versioned 156.0.8078.47 for Linux and 156.0.8078.47/.48 for Windows and Mac, will roll out to users over the coming days and weeks. This update cycle focuses heavily on memory corruption issues across several core browser components, aiming to reduce the attack surface for potential exploit attempts.

The risk

The desktop update resolves multiple critical vulnerabilities, including CVE-2026-113341, a memory corruption issue in the Skia graphics library reported by Google on October 3, 2026. Other critical fixes address memory corruption in Accessibility (CVE-2026-113279), CSS (CVE-2026-113072), and Paint (CVE-2026-113280), with several reported by Xinyang Ge in early October. A use-after-free flaw in Accessibility (CVE-2026-113271) was reported by Xinyang Ge from Anthropic, assisted by Claude, on October 8. Additionally, a critical memory corruption bug in WebRTC (CVE-2026-113303) was identified by OpenAI Codex Security.

Who is exposed

Users of Windows, macOS, and Linux desktop operating systems are exposed until they receive the Chrome 156.0.8078.47 or .48 update. ChromeOS devices are also affected, with the rollout of version 16836.19.0 (Browser version 156.0.8078.42) to the Stable channel. This ChromeOS update includes high-severity fixes for third-party libraries such as arc-keymaster and mali_kbase, which could allow kernel memory corruption or wild indirect calls. Browser-specific high-severity fixes address use-after-free vulnerabilities in Track, PDF, and Media components.

Cost and compliance

The source material does not specify direct financial costs or specific compliance framework impacts related to these vulnerabilities. Google notes that access to detailed bug information may remain restricted until a majority of users have updated, particularly if the flaw exists in a third-party library shared by other projects. Organizations should monitor their update adoption rates to ensure timely patching, as delayed updates could leave systems vulnerable to exploitation of the disclosed critical and high-severity flaws.

Our take on the response

Google’s rapid inclusion of 353 fixes in a single stable release demonstrates a proactive approach to mitigating widespread browser vulnerabilities. By addressing critical memory corruption issues in core components like Skia and WebRTC, the update patches known security flaws. Security teams should prioritize verifying update deployment across all managed endpoints to ensure immediate protection against these known threats.

What defenders should look for

Teams should monitor for unusual browser crashes or unexpected process terminations, which may indicate exploitation attempts of memory corruption flaws. Check for unexpected network connections originating from browser processes, particularly those involving WebRTC or media streaming components. Look for anomalous behavior in PDF rendering or accessibility services, as these components contain critical use-after-free vulnerabilities. Implement strict content security policies to limit the execution of untrusted scripts and reduce the impact of potential cross-site scripting attacks that could chain with these memory flaws.

Background: Cross-site scripting (XSS)

Cross-site scripting exploits the trust a browser places in a web page. An attacker injects malicious scripts into a vulnerable site. When another user visits that page, their browser executes the script. The attacker steals session tokens or redirects the victim. Proper input validation and output encoding stop this process.

Read the full guide: How Cross-Site Scripting Works Step by Step

What to do and how to stay safe

• Verify that all managed desktop and ChromeOS devices have successfully installed the Chrome 156 stable update.
• Monitor browser crash logs and system event logs for signs of exploitation attempts targeting memory corruption vulnerabilities.
• Ensure that third-party libraries and components are updated to their latest secure versions to mitigate shared risk.
• Review and enforce strict content security policies to limit the execution of untrusted scripts and reduce attack surface.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.