Chrome 156 got three security updates in nine days, with 426 fixes in total

Google promoted Chrome 156 to the stable channel on October 20 and then patched it twice in the following nine days. The launch build carried 353 security fixes. A follow-up on October 27 added 52 more, and another on October 29 added 21. That is 426 security fixes in one milestone, 11 of them rated Critical.

If you use Chrome on a computer, the build to look for is 156.0.8078.79 on Linux and 156.0.8078.79 or .80 on Windows and Mac. Anything older is missing at least some of these fixes.

What each update contains

The October 20 release moved Windows and Mac to 156.0.8078.47/.48 and Linux to 156.0.8078.47. Of its 353 security entries, Google rated 6 Critical, 61 High, 197 Medium and 89 Low. The Critical bugs sit in core parts of the browser: the Skia graphics library, accessibility, CSS, paint and WebRTC.

The October 27 build (156.0.8078.73/.74) fixed 4 Critical, 46 High and 2 Medium issues. SecurityWeek’s Ionut Arghire singled out CVE-2026-118306, a FileSystem memory bug that he wrote could allow code to run outside Chrome’s sandbox through a crafted HTML page. The October 29 build (156.0.8078.79/.80) fixed 1 Critical, 19 High and 1 Medium issue. Its Critical entry, CVE-2026-76024, is a memory corruption bug in MediaStream, the part of Chrome that handles live audio and video streams.

None of the three posts says that any of these bugs is being exploited in the wild, and SecurityWeek found no such mention either. Google also withholds the technical details for now, as it does with every security release:

“Access to bug details and links may be kept restricted until a majority of users are updated with a fix.”

That policy is the practical reason to update quickly. Once most people have the fix, the bug reports open up, and anyone still on an older build is running code with publicly documented holes.

Who is finding the bugs

The credit lines tell a story of their own. In the launch release, 266 of the 353 entries are credited simply to “Google”. Google does not say which internal tools found them, but its Chrome security team wrote in a July 30 post that it runs an agent harness built on Gemini to hunt for vulnerabilities, and that Chrome 149 and 150 together fixed 1,072 security bugs, more than the previous 23 milestones combined.

Outside researchers using AI models show up too. Several entries across the three releases are credited to “Xinyang Ge (Anthropic), assisted by Claude”, including two of the four Critical bugs in the October 27 build. Others are credited to “OpenAI Codex Security”, including the Critical WebRTC bug in the launch release. Independent researchers and a university lab also appear in the lists.

So the large numbers are not a sign that Chrome suddenly got worse. They show that bug-finding has sped up on every side, and that Google is fixing what comes in instead of letting it queue. Writing for PiunikaWeb, Dwayne Cubbins made the same point: the run of updates can make Chrome look messy, but it reflects defenders getting faster at finding old bugs.

Attackers have access to similar tools, though. That is why Google says it is piloting two security releases per week, to shrink the window between a fix landing in public source code and reaching users.

Why the releases come so close together

This is also the first autumn of Chrome’s faster schedule. Since Chrome 153 on September 8, a new major version arrives every two weeks instead of every four. Weekly security builds continue in between, so a single milestone like Chrome 156 can see several updates before the next one replaces it.

Chrome 156 matters more than most for businesses. Under the new plan, the Extended Stable channel only moves to every fourth milestone, and Google names Chrome 156 and Chrome 160 as examples. The October 29 post confirms that both Stable and Extended Stable moved to 156.0.8078.79. Companies that held back on Extended Stable are now on the same major version as everyone else, and their next feature jump is Chrome 160.

What to do now

On a computer, open the three-dot menu, go to Help, then About Google Chrome. Chrome checks for an update and downloads it. The step people skip is the restart: the fix only applies after you click Relaunch, and a browser left open for weeks can sit on an old build even with automatic updates on. Google’s own advice is to click the update message in the top-right corner when it appears.

On Android, update Chrome from the Google Play Store. Google’s posts say the desktop builds “will roll out over the coming days/weeks”, so you may need to check again if the update does not appear yet.

If you manage a fleet, Google recommends the RelaunchNotification policy to push people to restart, and its Chrome Enterprise dashboard to see which versions are still out there.

What we do not know yet is how many of the 426 bugs were actually reachable from a normal web page, or how many came from AI tools versus manual review. Google has not published that breakdown, and the restricted bug reports will not answer it for some weeks.