Threat reportVulnerabilityTL-2026-4102
Google Chrome 156 Security Update Fixes 353 Flaws Including 6 Critical Memory-Corruption Vulnerabilities (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280, CVE-2026-113303, CVE-2026-113271)
Google Chrome 156 Security Update Fixes 353 Flaws Including (TL-2026-4102), also tracked as Chrome 156 stable security update, is a critical-severity software vulnerability scored CVSS 9.6, first published 2026-10-22. It has no confirmed attribution, affects Google Chrome (Windows, macOS, Linux), references 7 CVEs (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072), maps to 3 MITRE ATT&CK techniques (T1203, T1204.001, T1211), and is covered by 9 detection rules and 9 indicators of compromise.
- CVSS
- 9.6/10Critical
- CVEs
- 7Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-4102
- Threat ID
- TL-2026-4102
- Also known as
- Chrome 156 stable security update
- Severity
- CRITICAL
- CVSS
- 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- all-sectors
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
How Google Chrome 156 Security Update Fixes 353 Flaws Including works
Google released Chrome 156.0.8078.47 (Linux) and 156.0.8078.47/.48 (Windows/Mac) on 2026-10-20, fixing 353 security issues including six Chromium-critical memory-corruption/use-after-free flaws in Skia, Accessibility, CSS, Paint and WebRTC. No source states active exploitation or a public PoC; the exposure is patch-adoption driven.
Google Chrome 156 (stable channel, released 2026-10-20) remediates 353 security issues. Six are rated Critical by the Chromium project: CVE-2026-113341 (Skia, memory corruption, credited to Google internal), CVE-2026-113279 (Accessibility, memory corruption), CVE-2026-113072 (CSS, memory corruption), CVE-2026-113280 (Paint, memory corruption), CVE-2026-113271 (Accessibility, use-after-free) -- the last four credited to Xinyang Ge (Anthropic/Claude) per the secondary source -- and CVE-2026-113303 (WebRTC, memory corruption, credited to kylebot of OpenAI Codex Security). A further High-severity item named in the source is CVE-2026-113101 (SiteIsolation use-after-free, reported by Quyen Son of VinFast, $10,000 bounty). The source also mentions additional high-severity issues in FileSystem, ANGLE, V8, GPU and Network components, which could not be individually verified.
NVD records (published 2026-10-20) describe each flaw as exploitable by a remote attacker via a crafted HTML page, requiring user interaction (CVSS v3.1 AV:N/AC:L/PR:N/UI:R). CVE-2026-113072 (CSS) is the most severe in NVD at 9.6 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) because the description states arbitrary code execution OUTSIDE the sandbox, i.e. a sandbox escape. CVE-2026-113279, -113280, -113303, -113271 and -113101 are scored 8.8 High and describe code execution INSIDE the renderer sandbox (CWE-119 for the memory-corruption entries, CWE-416 for the use-after-free entries); such bugs typically need chaining with a separate sandbox escape for full system compromise. CVE-2026-113341 (Skia) is described by NVD as Android-specific, limited to reading memory inside the sandbox, CVSS 6.5 Medium (confidentiality only), CWE-119, despite the Chromium Critical rating; it was last modified 2026-10-21 and was still awaiting NVD analysis.
Exploitation status: the source article states Google's announcement does not say the critical flaws are exploited in active attacks. No public PoC is cited in any source reviewed. A CISA KEV catalog snapshot (release 2026.10.21) showed none of the seven CVEs in the portion of the catalog that could be read (first ~100K of ~1.8M characters), so absence from KEV is not fully confirmed. Google's Chrome Releases post (URL cited by NVD) could not be rendered by the fetch tool, so per-CVE detail beyond NVD and the secondary article is unverified. Notably, several reports are credited to AI-assisted vulnerability research programs; the AI systems are the discovery tooling, not part of the attack surface, so this is not an ATLAS threat. Priority for defenders: roll Chrome and Chromium-based browsers (which inherit Blink/V8/Skia/ANGLE fixes) to 156.0.8078.47 or later, and prioritise internet-facing user populations and unmanaged endpoints.
MITRE ATT&CK techniques used in TL-2026-4102
Execution
T1203 Exploitation for Client Execution; T1204.001 Malicious Link
Defense Evasion
Affected products and versions in Google Chrome 156 Security Update Fixes 353 Flaws Including
Remediation for Google Chrome 156 Security Update Fixes 353 Flaws Including
Patches
- Google Chrome 156.0.8078.47 (Linux)
- Google Chrome 156.0.8078.47/.48 (Windows, macOS)
Immediate actions
- Update Google Chrome to 156.0.8078.47 (Linux) or 156.0.8078.47/.48 (Windows/Mac) or later and relaunch the browser
- Verify patch compliance through endpoint inventory (chrome.exe / Google Chrome file version below 156.0.8078.47 is vulnerable)
- Prioritise patching of the CSS flaw CVE-2026-113072, the only one NVD describes as a sandbox escape (CVSS 9.6)
Workarounds
- No vendor workaround documented in sources; restrict browsing to untrusted sites via web filtering until patched
- Use browser isolation or managed-device access for high-risk users where immediate patching is not possible
Longer-term hardening
- Enforce automatic browser updates and a maximum browser-version lag policy through enterprise management
- Keep Chrome site isolation and sandboxing enabled; avoid --no-sandbox deployments
- Track Chromium-derived browsers (Edge, Brave, Opera, Vivaldi, Electron apps) for downstream releases that ingest these fixes
CVEs associated with Google Chrome 156 Security Update Fixes 353 Flaws Including
CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280, CVE-2026-113303, CVE-2026-113271, CVE-2026-113101
Weaknesses (CWE) in Google Chrome 156 Security Update Fixes 353 Flaws Including
Timeline of Google Chrome 156 Security Update Fixes 353 Flaws Including
- NVD publishes CVE-2026-113341 (Skia) as Android-specific, in-sandbox memory read, CVSS 6.5 Medium, while Chromium rates it Critical.
- NVD publishes records for CVE-2026-113279, -113072, -113280, -113303, -113271 and -113101, all affecting Chrome prior to 156.0.8078.47, each referencing the Chrome Releases post and a Chromium issue.
- Google publishes the Chrome 156 stable desktop update (156.0.8078.47 Linux; 156.0.8078.47/.48 Windows/Mac) fixing 353 security issues.
- CISA KEV catalog release 2026.10.21 reviewed: none of the seven CVEs seen in the portion of the catalog that could be read.
- Cyber Security News reports the 353-fix release and six critical flaws, noting Google does not state active exploitation.
- NVD last-modified date for CVE-2026-113341; record still awaiting full analysis.
Sources cited for Google Chrome 156 Security Update Fixes 353 Flaws Including
- Google Releases Massive Chrome Security Update Fixing 353 Flaws, Including 6 Critical Vulnerabilities
- Chrome Releases: Stable Channel Update for Desktop (156.0.8078.47)
- NVD - CVE-2026-113341 (Skia)
- NVD - CVE-2026-113279 (Accessibility)
- NVD - CVE-2026-113072 (CSS)
- NVD - CVE-2026-113280 (Paint)
- NVD - CVE-2026-113303 (WebRTC)
- NVD - CVE-2026-113271 (Accessibility UAF)
- NVD - CVE-2026-113101 (SiteIsolation UAF)
- Chromium issue 570638836 (CVE-2026-113072)
- Chromium issue 570093145 (CVE-2026-113279)
- CISA Known Exploited Vulnerabilities catalog (release 2026.10.21)
Detection coverage for TL-2026-4102
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4102 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.