Google on Tuesday announced the promotion of Chrome 156 to the stable channel with patches for 353 vulnerabilities.
Most of the resolved security defects were memory safety flaws, including 163 memory corruption bugs, 125 use-after-free issues, and 17 out-of-bounds reads. Of the remaining weaknesses, 36 are improper input validations.
The browser refresh resolves six critical-severity vulnerabilities: five memory corruption defects and one use-after-free bug.
Chrome 156 also resolves 61 high-severity security issues, 197 medium-severity flaws, and 89 low-severity weaknesses.
Google makes no mention of any of these vulnerabilities being exploited in the wild.
Per the internet giant’s advisory, no bug bounty reward will be paid for 285 vulnerabilities. They were either found by Google (266), Xinyang Ge (Anthropic – assisted by Claude), or OpenAI Codex Security.
Google says it handed out $50,000 in bug bounties for 24 of the vulnerabilities, but the final amount will likely be much higher, as the company has not disclosed the amounts paid for 44 of the flaws.
Quyen Son at VinFast received the highest reward, of $10,000, for a high-severity use-after-free issue in Site Isolation.
The latest Chrome iteration is now rolling out as versions 156.0.8078.47/.48 for Windows and macOS, and as version 156.0.8078.47 for Linux.
Related: PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
Related: Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
Related: Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
Related: Microsoft Patches Two Dozen RCE Flaws in Office
