Chrome 156 Skia Memory Corruption Fixes Address 353 Desktop Security Flaws

Google has promoted Chrome 156 to the stable channel for desktop operating systems, delivering a comprehensive update that resolves 353 identified security flaws. The release, versioned as 156.0.8078.47 for Linux and 156.0.8078.47 or .48 for Windows and Mac, begins rolling out to users over the coming days and weeks. This update prioritizes critical memory safety issues that could potentially allow attackers to execute arbitrary code or crash the browser environment.

In plain English

The most severe issues in this release involve memory corruption and use-after-free errors within core browser components. Critical flaws were found in Skia, the graphics library, as well as in Accessibility, CSS, and Paint modules. These bugs allow malicious web content to manipulate how the browser handles memory, potentially leading to remote code execution. Additionally, a critical use-after-free bug in Accessibility and a memory corruption issue in WebRTC were patched.

The background

The vulnerabilities were reported by various researchers, including Google engineers and Xinyang Ge, between early October and mid-October 2026. For instance, CVE-2026-113341 in Skia was reported on October 3, while several Accessibility and CSS flaws were reported on October 5 and 6. Google restricts access to detailed bug information until a majority of users have updated, ensuring attackers cannot exploit known weaknesses before patches are widely deployed.

What changes now

ChromeOS version 16836.19.0 has also entered the stable channel. This update includes high-severity fixes for third-party libraries, such as kernel memory corruption in mali_kbase and mali drivers. It also addresses use-after-free issues in the Track and PDF modules. The browser component within ChromeOS receives specific security patches, including critical use-after-free fixes in Track and high-severity fixes in PDF and Media.

Who needs to act first

Security operations teams should prioritize updating systems that expose users to untrusted web content, such as public kiosks or shared workstations. Verify that automatic update mechanisms are functioning correctly across all endpoints. If manual deployment is required, test the update in an isolated environment before wide rollout to ensure compatibility with internal tools. Monitor for any unusual browser behavior post-update and maintain backups of critical user data to mitigate potential rollback issues.

What to do and how to stay safe: Google Chrome

• Ensure automatic updates are enabled on all desktop and ChromeOS devices to receive the patch promptly.
• Verify that all endpoints have successfully installed Chrome 156.0.8078.47 or later versions.
• Monitor system logs for any anomalies related to browser crashes or unexpected memory usage.
• Educate users to avoid visiting untrusted websites until all devices are confirmed updated.

Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits

General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific CVEs are rated as critical in this update?

Critical CVEs include CVE-2026-113341 (Skia), CVE-2026-113279 (Accessibility), CVE-2026-113072 (CSS), CVE-2026-113280 (Paint), CVE-2026-113271 (Accessibility), and CVE-2026-113303 (WebRTC).

Is there a fix available for the ChromeOS vulnerabilities?

Yes, ChromeOS version 16836.19.0 includes fixes for high-severity issues in third-party libraries and the browser component, addressing flaws in mali_kbase, mali, Track, and PDF.

When were these vulnerabilities reported to Google?

The critical desktop vulnerabilities were reported between October 3 and October 8, 2026, while ChromeOS browser fixes address bugs reported in late September and early October 2026.