Chrome 156 ships with 52 security fixes, several found with AI help

Google has released Chrome 156 (156.0.8078.73/.74) to the stable channel for Windows, Mac, and Linux, rolling out over the coming days and weeks. The update includes 52 security fixes, among them several rated Critical and many rated High severity, covering memory corruption, use-after-free, and input validation bugs across components including FileSystem, Skia, V8, WebRTC, PDFium, and more.

A notable number of the reported bugs were found with AI assistance. Several Critical and High-severity issues, including memory corruption in FileSystem, improper input validation in FileAPI, and a use-after-free in Animation, were reported by Xinyang Ge of Anthropic, credited as assisted by Claude. Separately, OpenAI's Codex Security team is credited with finding several High-severity use-after-free bugs in Turbolev, ImageCapture, Video, and PDFium. Other researchers credited include Mozilla, Ada Logics, and independent security researchers, alongside Google's own internal teams using tools like Address Sanitizer, MemorySanitizer, and libFuzzer.

Google's release notes say access to some bug details remains restricted until a majority of users have updated or until fixes land in third-party libraries other projects depend on.

Why it matters

The update patches dozens of memory-safety bugs that could be exploited for remote code execution, so users should update Chrome promptly.

Source: Google Chrome Releases