Google released Chrome 156 on Wednesday with fixes for 353 security vulnerabilities, six of them rated critical. Google reported no evidence of active exploitation, and the source material names no individual CVEs.
Severity Breakdown of the 353 Chrome 156 Fixes
The batch includes 6 critical, 61 high, 197 medium and 89 low severity flaws. The fixes ship in Chrome 156.0.8078.47 and 156.0.8078.48 for Windows, macOS and Linux.
The release is separate from Chrome 155, which was published on October 16 and fixed 10 flaws, including a critical prerender bug. Chrome 156 is a far larger batch.
Chrome 156 Memory Corruption and Use-After-Free Bugs
Memory safety issues account for most of the release. The release notes list 163 memory corruption bugs and 125 use-after-free bugs, plus 17 out-of-bounds reads and 36 improper input validation flaws. Those categories make up the largest share of the 353 fixes.
Bug Bounty Payouts
Google paid $50,000 in bounties across 24 flaws. The top reward was $10,000, awarded for a use-after-free vulnerability reported by Quyen Son of VinFast. The remaining 285 flaws received no bounty.
Why 285 Chrome 156 Flaws Earned No Bounty
The reporting does not explain why those 285 flaws carried no bounty, and the 24 rewarded plus 285 unrewarded flaws do not add up to the 353 total, so the remaining fixes are unaccounted for in the report. It gives only the counts and the size of the top payout.
How the 353 Chrome 156 Fixes Break Down
The severity counts add up to the full batch: 6 critical plus 61 high, 197 medium and 89 low flaws equals 353. Of those, 67 are rated critical or high. The bug classes cut across the severity tiers: 163 memory corruption bugs, 125 use-after-free bugs, 17 out-of-bounds reads and 36 improper input validation flaws together total 341 of the 353 fixes. Chrome 155, released five days earlier, fixed 10 flaws, including a critical prerender bug.
Browser Versions and Platforms
The fixed builds are numbered 156.0.8078.47 and 156.0.8078.48. Google distributes them for Windows, macOS and Linux, so desktop installations on all three operating systems fall within the release. Combined, memory corruption and use-after-free bugs number 288 of the 353 fixes.
Exploitation Status
Google reported no evidence of active exploitation of the flaws fixed in Chrome 156, so the patches address vulnerabilities not known to be under attack. The source does not name individual CVEs, so no specific identifiers are tied to the six critical flaws.
Timeline
Chrome 156 was released on October 21. The release follows the Chrome 155 update from five days earlier.
Response and Update Details
Google’s response is the update itself. Users on Windows, macOS and Linux receive the fixes through Chrome 156.0.8078.47 and 156.0.8078.48.
Impact
The update is the second Chrome security release in a week, following Chrome 155 on October 16. Unpatched browsers face exposure to memory-corruption attacks, the dominant class in the release. With 163 memory corruption and 125 use-after-free bugs, the two categories together account for 288 of the 353 fixes.
The 89 low-severity and 197 medium-severity fixes make up most of the count, but the six critical flaws and 61 high-severity flaws are the ones that carry the most risk if exploited. No exploitation has been reported for any of them. Google’s bounty program covered only 24 of the 353 flaws, and the $50,000 total was paid across those 24 reports.
