# Chrome 156 stable release patches 353 security flaws, six critical

> **Key takeaway:** Chrome 156.0.8078.47 for Linux contains 353 security fixes including six critical vulnerabilities in Skia, Accessibility, CSS, Paint, and WebRTC.

**Published:** 2026-10-20T20:45:52.575000+00:00 
**Source:** Google Chromium Engineering Releases 
**Category:** bigtech-foss 
**Canonical URL:** https://fosswire.org/news/chrome-156-stable-release-patches-353-security-flaws-six-cri.html 

## Summary
Google promoted Chrome 156 to the stable channel for Windows, Mac and Linux. The Linux build is version 156.0.8078.47. The release includes 353 security fixes total, with six rated critical and 18 rated high severity. Notable critical bugs include memory corruption in Skia, CSS, Paint, and WebRTC components, plus use-after-free flaws in Accessibility. Several high-severity issues were reported by external security researchers who received bug bounties ranging from $1,000 to $10,000.

## Critical vulnerabilities in Chrome 156
- **CVE-2026-113341**: Memory corruption in Skia (Google internal)
- **CVE-2026-113279**: Memory corruption in Accessibility (Xinyang Ge)
- **CVE-2026-113072**: Memory corruption in CSS (Xinyang Ge)
- **CVE-2026-113280**: Memory corruption in Paint (Xinyang Ge)
- **CVE-2026-113271**: Use-after-free in Accessibility, reported by Xinyang Ge (Anthropic) with assistance from Claude
- **CVE-2026-113303**: Memory corruption in WebRTC, reported by OpenAI Codex Security (kylebot)
- Largest external bounty: $10,000 for high-severity CVE-2026-113101 (use-after-free in SiteIsolation) reported by Quyen Son at VinFast

## Why it matters
The scale of security fixes and involvement of AI-assisted vulnerability discovery (Claude, OpenAI Codex Security) marks a notable shift in how browser vulnerabilities are being found and reported.