Chrome gets security update that closes 21 vulnerabilities

Google has released a new desktop version of Chrome that fixes 21 security vulnerabilities. Browsers on the Stable and Extended Stable channels have been upgraded to version 156.0.8078.79/.80 on Windows and Mac, and to version 156.0.8078.79 on Linux. The update is being rolled out gradually to users, so it may not reach everyone’s browser at the same time.

The highest risk is in the MediaStream component

The most serious vulnerability in the list is a MediaStream memory corruption bug tracked as CVE-2026-76024. Google classified this vulnerability as critical on the Chromium scale; on the NVD side, it is recorded as medium with a CVSS score of 6.5. The vulnerability can allow an attacker to read memory inside the browser’s sandbox through a crafted HTML page. The fact that content served in the browser can trigger this kind of bug means even an ordinary web page can be an attack surface.

Seven high-risk vulnerabilities can lead to code execution

Most of the high-risk vulnerabilities in the update are memory corruption and use-after-free bugs. All seven vulnerabilities identified in this batch have a CVSS score of 8.8 and are marked high on the Chromium scale:

CVE-2026-76031 Use-after-free in the Input component. CVE-2026-76030 Memory corruption in FileSystem. CVE-2026-76029 Memory corruption in Network. CVE-2026-76028 Use-after-free in FileSystem. CVE-2026-76026 Memory corruption in Autofill. CVE-2026-76025 again, use-after-free in FileSystem. CVE-2026-119271 and use-after-free in the Skia graphics engine.

According to NVD records, each of these vulnerabilities can allow a remote attacker to execute arbitrary code inside the sandbox through a crafted HTML page. It is notable that the FileSystem component appears with three separate bugs in the same bulletin; Google is keeping most bug details restricted until most users have updated. According to bug bounty program records, some of these vulnerabilities were reported by external researchers.

No evidence of active exploitation

Google’s statement does not include any information indicating that these vulnerabilities are being actively exploited. Still, this is not always guaranteed with browser updates: when Chrome detects exploitation, it usually calls this out separately in the bulletin text. The fact that bug details are closed does not mean the vulnerabilities are only theoretical either; the information is being withheld only to make attackers’ lives harder.

How to apply the update

In Chrome, the update downloads in the background, but the new version only takes effect when the browser is restarted. So you should not assume the vulnerabilities are fixed just because the download has completed. Type chrome://settings/help into the address bar to see the version number and manually start the update if one is available. If the version is 156.0.8078.79 or higher, the browser is up to date; if not, close and reopen Chrome after the update finishes.

The same version also covers the Extended Stable channel, so machines using this channel in enterprise environments also need to be updated. On Linux distributions, Chrome is updated through the package manager; it is enough to verify that the version coming from the distribution’s own repository is 156.0.8078.79.

Because the browser is the most used and most attacked software during the day, you should not postpone these kinds of bulk fixes. After installing the update, fully closing and reopening the browser once means the vulnerabilities are actually fixed.

Source: Chrome Releases · NVD