Google Fixes 52 Chrome Security Flaws, Including 4 Critical Memory-Corruption Bugs

🔴 UPDATE RECOMMENDED — NO WORKAROUND EXISTS OTHER THAN UPDATING: Google's Chrome 156 stable channel release fixes 52 vulnerabilities, including 4 rated Critical (memory corruption and input-validation issues in FileSystem, FileAPI, Skia and Layout).

The underlying report does not confirm active exploitation of any of these flaws, but Chrome is the most widely deployed browser in most enterprise environments, making it a high-value target the moment technical details circulate. Push the update to all managed endpoints.

overview

On October 28, 2026, Google released Chrome 156 stable channel builds 156.0.8078.73/.74 (Windows, Mac) and 156.0.8078.73 (Linux), fixing 52 security vulnerabilities: 4 Critical, 46 High and 2 Medium severity. CVSS scores are not published for this release. The source article does not report active exploitation, confirm remote code execution for any specific CVE, or describe an attack method — the risk here is the volume and severity class of memory-safety issues (use-after-free, memory corruption, out-of-bounds write) typical of browser engine components.

vulnerability details - critical severity

46 High-severity CVEs span components including V8 (the JavaScript engine), ANGLE, Skia, PDFium, WebRTC, WebAudio, Media, SVG and Compositing — mostly use-after-free and memory-corruption classes. 2 Medium-severity CVEs affect Paint and Animation components. Given the volume, Avertium recommends treating this as a standard but mandatory browser patch cycle rather than tracking each CVE individually, unless a specific one is later confirmed exploited. Note: we were unable to verify a direct link to Google's own Chrome Releases blog post for this specific build at the time of writing; the CVE and version details above come from the cybersecuritynews.com report cited below.

Notable reporting detail: Several of the critical and high-severity findings (FileSystem, FileAPI, Skia, Layout) were credited to a Google-affiliated researcher working with Claude (Anthropic's AI model) as an assistive tool. The source article notes this credit does not establish that AI tooling independently found or verified the issues — it reflects assisted human research.

potential impact

• Browser compromise: Memory corruption and use-after-free bugs in a browser engine are the typical building blocks of remote code execution exploit chains, though no specific exploit path is confirmed in the source material
• Broad attack surface: Affected components (V8, PDFium, WebRTC, Media) are reachable simply by visiting a malicious or compromised webpage, opening a crafted PDF, or joining a WebRTC-based call
• Enterprise exposure: Chrome is typically the default or primary browser across most managed fleets, so unpatched endpoints represent a wide and consistent attack surface

indicators of compromise

None published. The source article does not report active exploitation, in-the-wild attacks, or any IOC set for this release.

monitoring and telemetry

• Track Chrome version compliance across managed endpoints via your EDR/MDM console or browser management policy
• Monitor for Chrome crash reports or renderer-process crashes that could indicate exploitation attempts against memory-safety bugs
• If you manage Chrome via Google Admin Console or GPO, confirm auto-update policies are enabled and not overridden

compliance impact

PCI DSS: Requirement 6 (develop and maintain secure systems) requires timely patching of critical vulnerabilities in software used to access cardholder data environments, including browsers.

HIPAA: Unpatched browser vulnerabilities on workstations accessing ePHI fall under the Security Rule's technical safeguards for malicious software protection.

ISO/IEC 27001: Relevant control: A.8.8 (management of technical vulnerabilities).

NIST CSF: Maps to PROTECT (platform security, maintenance).

GDPR: Indirect: unpatched endpoint software increases risk of compromise leading to personal data exposure.

recommendations

PRIORITY 1 — Update Now:

• Update Chrome to 156.0.8078.73/.74 (Windows, Mac) or 156.0.8078.73 (Linux) on all endpoints
• Chrome normally updates automatically on relaunch; confirm via Chrome menu → Help → About Google Chrome, then relaunch
• Linux users should update through their distribution's package manager

PRIORITY 2 — Enforce at Scale:

• Confirm managed-device policies (Google Admin Console, GPO, Intune) allow and do not delay auto-updates
• For fleets with delayed-update policies, prioritize rollout given the number of Critical and High-severity fixes in this release

SUPPORTING DOCUMENTATION

• Cyber Security News: Google Fixes 52 Chrome Security Flaws