Memory Bugs Account for Most of Chrome’s 353 New Security Fixes

What it is

Chrome 156 reached the stable channel on Tuesday with patches for 353 vulnerabilities. The page is SecurityWeek's summary of Google's advisory. Google does not mention exploitation in the wild for any of them.

Preconditions / Affected

Chrome builds before 156 are affected. The fixed builds are:

• Windows and macOS: 156.0.8078.47/.48
• Linux: 156.0.8078.47 only

Severity and weakness breakdown

• Critical: 6 (five memory corruption, one use-after-free)
• High: 61
• Medium: 197
• Low: 89
• Weakness classes: 163 memory corruption, 125 use-after-free, 17 out-of-bounds read, 36 improper input validation

Bounties and sources

• 285 bugs earn no reward. Google found 266 of them. The rest were found by Xinyang Ge of Anthropic (assisted by Claude) and by OpenAI Codex Security.
• Google paid $50,000 for 24 bugs. It did not disclose the amounts for another 44, so the total will likely be higher.
• The top reward was $10,000, paid to Quyen Son of VinFast. It was for a high-severity use-after-free in Site Isolation.

What to do

Update Chrome to 156.0.8078.47 (Linux) or 156.0.8078.47/.48 (Windows, macOS). The page gives no CVE identifiers, no per-bug details and no workarounds, so the advisory itself is needed to see which fixes matter for a given environment.