# Google Chrome 156 Security Update Fixes 353 Flaws Including 6 Critical Memory-Corruption Vulnerabilities (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280, CVE-2026-113303, CVE-2026-113271)

> Google released Chrome 156.0.8078.47 (Linux) and 156.0.8078.47/.48 (Windows/Mac) on 2026-10-20, fixing 353 security issues including six Chromium-critical memory-corruption/use-after-free flaws in Skia, Accessibility, CSS, Paint and WebRTC. No source states active exploitation or a public PoC; the exposure is patch-adoption driven.

- **Published:** 2026-10-22T03:52:20Z
- **Last reviewed:** 2026-10-22T03:52:20Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4102
- **ID:** TL-2026-4102
- **Severity:** CRITICAL (CVSS 9.6)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280, CVE-2026-113303, CVE-2026-113271, CVE-2026-113101

## Description

Google Chrome 156 (stable channel, released 2026-10-20) remediates 353 security issues. Six are rated Critical by the Chromium project: CVE-2026-113341 (Skia, memory corruption, credited to Google internal), CVE-2026-113279 (Accessibility, memory corruption), CVE-2026-113072 (CSS, memory corruption), CVE-2026-113280 (Paint, memory corruption), CVE-2026-113271 (Accessibility, use-after-free) -- the last four credited to Xinyang Ge (Anthropic/Claude) per the secondary source -- and CVE-2026-113303 (WebRTC, memory corruption, credited to kylebot of OpenAI Codex Security). A further High-severity item named in the source is CVE-2026-113101 (SiteIsolation use-after-free, reported by Quyen Son of VinFast, $10,000 bounty). The source also mentions additional high-severity issues in FileSystem, ANGLE, V8, GPU and Network components, which could not be individually verified.

NVD records (published 2026-10-20) describe each flaw as exploitable by a remote attacker via a crafted HTML page, requiring user interaction (CVSS v3.1 AV:N/AC:L/PR:N/UI:R). CVE-2026-113072 (CSS) is the most severe in NVD at 9.6 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) because the description states arbitrary code execution OUTSIDE the sandbox, i.e. a sandbox escape. CVE-2026-113279, -113280, -113303, -113271 and -113101 are scored 8.8 High and describe code execution INSIDE the renderer sandbox (CWE-119 for the memory-corruption entries, CWE-416 for the use-after-free entries); such bugs typically need chaining with a separate sandbox escape for full system compromise. CVE-2026-113341 (Skia) is described by NVD as Android-specific, limited to reading memory inside the sandbox, CVSS 6.5 Medium (confidentiality only), CWE-119, despite the Chromium Critical rating; it was last modified 2026-10-21 and was still awaiting NVD analysis.

Exploitation status: the source article states Google's announcement does not say the critical flaws are exploited in active attacks. No public PoC is cited in any source reviewed. A CISA KEV catalog snapshot (release 2026.10.21) showed none of the seven CVEs in the portion of the catalog that could be read (first ~100K of ~1.8M characters), so absence from KEV is not fully confirmed. Google's Chrome Releases post (URL cited by NVD) could not be rendered by the fetch tool, so per-CVE detail beyond NVD and the secondary article is unverified. Notably, several reports are credited to AI-assisted vulnerability research programs; the AI systems are the discovery tooling, not part of the attack surface, so this is not an ATLAS threat. Priority for defenders: roll Chrome and Chromium-based browsers (which inherit Blink/V8/Skia/ANGLE fixes) to 156.0.8078.47 or later, and prioritise internet-facing user populations and unmanaged endpoints.

## MITRE ATT&CK

- T1203 Exploitation for Client Execution
- T1204.001 Malicious Link
- T1211 Exploitation for Stealth

## Sources

- [Google Releases Massive Chrome Security Update Fixing 353 Flaws, Including 6 Critical Vulnerabilities](https://cybersecuritynews.com/chrome-security-update-fixing-353-flaws/)
- [Chrome Releases: Stable Channel Update for Desktop (156.0.8078.47)](https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html)
- [NVD - CVE-2026-113341 (Skia)](https://nvd.nist.gov/vuln/detail/CVE-2026-113341)
- [NVD - CVE-2026-113279 (Accessibility)](https://nvd.nist.gov/vuln/detail/CVE-2026-113279)
- [NVD - CVE-2026-113072 (CSS)](https://nvd.nist.gov/vuln/detail/CVE-2026-113072)
- [NVD - CVE-2026-113280 (Paint)](https://nvd.nist.gov/vuln/detail/CVE-2026-113280)
- [NVD - CVE-2026-113303 (WebRTC)](https://nvd.nist.gov/vuln/detail/CVE-2026-113303)
- [NVD - CVE-2026-113271 (Accessibility UAF)](https://nvd.nist.gov/vuln/detail/CVE-2026-113271)
- [NVD - CVE-2026-113101 (SiteIsolation UAF)](https://nvd.nist.gov/vuln/detail/CVE-2026-113101)
- [Chromium issue 570638836 (CVE-2026-113072)](https://issues.chromium.org/issues/570638836)
- [Chromium issue 570093145 (CVE-2026-113279)](https://issues.chromium.org/issues/570093145)
- [CISA Known Exploited Vulnerabilities catalog (release 2026.10.21)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4102