Google released a Chrome 156 security update fixing 21 vulnerabilities, including a critical memory corruption bug in MediaStream tracked as CVE-2026-76024. Google reports no exploitation of any of the flaws.
Chrome 156.0.8078.79 Brings 21 Security Fixes
The update ships as version 156.0.8078.79 or .80 on Windows and Mac, and 156.0.8078.79 on Linux. It applies to the Stable and Extended Stable channels.
Of the 21 vulnerabilities, one is rated critical, 19 high and one medium.
The Critical MediaStream Memory Corruption Bug
The critical flaw is CVE-2026-76024, a memory corruption bug in MediaStream. The reporting does not give further technical detail on how the flaw can be triggered. MediaStream is the part of the browser associated with media capture and streaming.
Memory Safety Dominates the Patch Set
Sixteen of the 21 fixed flaws are memory corruption or use-after-free bugs. That is roughly three-quarters of the update. Memory-corruption bugs are common first steps in browser exploits, which is why they make up the bulk of the severe fixes in a release like this one.
No Known Attacks Against Chrome 156 Vulnerabilities
Google reports no exploitation, and the reporting identifies no in-the-wild attacks tied to the update. The impact described is therefore potential: the fixes address vulnerabilities that could be used if attackers developed exploits for them.
Second Chrome 156 Security Update in a Week
This is the second Chrome 156 security update in a week. The earlier release fixed 52 flaws. Together the two releases address 73 vulnerabilities in the same major version over a short span.
What Two Chrome 156 Security Releases in a Week Show
Two security releases in one week, one of them with 52 fixes, shows how many defects the Chrome 156 line carried when it first shipped. The 21 flaws in this follow-up add to that total, and the weight of memory-safety bugs in both indicates where the bulk of the browser’s security work sits.
The reporting leaves several details unstated, including who reported CVE-2026-76024, what bounty Google may pay and what conditions an attacker would need to reach the MediaStream code. Without that information, the main verified facts are the version numbers, the severity breakdown and the absence of reported attacks. Browser users receive the fix by updating Chrome and restarting it, since the patched build only takes effect after a relaunch.
Version Numbers and Platform Coverage in the Chrome 156 Release
Google lists two build numbers for Windows and Mac, 156.0.8078.79 and 156.0.8078.80, and one for Linux, 156.0.8078.79. The update covers both the Stable channel and the Extended Stable channel. Because the release spans three desktop platforms under a single major version, the 21 fixes apply across Windows, Mac and Linux.
Severity Breakdown: One Critical, 19 High, One Medium
The severity distribution is lopsided. A single critical issue, CVE-2026-76024, stands apart, while the high-severity group accounts for 19 of 21 flaws, or about 90 percent. Only one flaw is rated medium. Sixteen of the 21 are memory corruption or use-after-free bugs, so five fall into other categories that the reporting does not describe.
Chrome 156 Has Now Received 73 Fixes Across Two Security Releases
The earlier Chrome 156 security release fixed 52 flaws and this one fixes 21, for 73 in total across the two releases. Google said it is aware of no exploitation of the flaws in this update. Users receive the fixes through the browser’s normal update and restart cycle.
Open Questions About Critical Bug CVE-2026-76024
The reporting does not name the researcher who found CVE-2026-76024 or say what conditions an attacker would need to reach the vulnerable MediaStream code. It also does not say whether the 52 flaws from the earlier release and the 21 here overlap in any component.
