Chrome 156: install the fixes, then check the version
Google says Chrome 156 includes 353 security fixes. Its October 20 bulletins name the versions for Windows, Mac, Linux and Android. Check the installed version after updating, rather than stopping at the download.
Getting started
Generated image · SecuFocus
At a glance
Key points
If you use Chrome on desktop or Android, check for the stable-channel update and confirm the installed version. Google reports 353 security fixes in Chrome 156, including several rated critical. The rollout is gradual; the bulletin does not report active exploitation.
The versions announced on October 20
The desktop bulletin announces Chrome 156.0.8078.47 for Linux and 156.0.8078.47 or 156.0.8078.48 for Windows and Mac. The Android bulletin names 156.0.8078.47 and says it includes the corresponding desktop security fixes unless otherwise noted.
Google says the desktop rollout will take days or weeks, with Android availability on Google Play over the next few days. Not seeing the update immediately does not, by itself, mean something is broken. These are the versions in the October 20 bulletins, not a reason to downgrade if you already have a newer release.
| Platform | Version in the bulletin |
|---|---|
| Windows and Mac | 156.0.8078.47 or 156.0.8078.48 |
| Linux | 156.0.8078.47 |
| Android | 156.0.8078.47 |
A separate bulletin for iPhone and iPad
On 23 October, Google announces Chrome 156.0.8078.54 for iOS, reaching the App Store over the following hours. This bulletin describes stability and performance improvements. It does not assign the desktop bulletin’s 353 security fixes to the iOS build, so neither do we.
Critical flaws, without a report of active exploitation
The figure of 353 security fixes comes from Google. Among the flaws rated Critical, the bulletin lists CVE-2026-113341, memory corruption in Skia, and CVE-2026-113303, memory corruption in WebRTC. It does not describe this release as a response to active exploitation.
Google keeps some technical details restricted until most users have received a fix, or while a third-party library remains unpatched in other products. That limits what can be said about possible attacks. SecuFocus read the bulletins; we did not install these releases for testing or reproduce the flaws.
On 22 October, NVD added a configuration for CVE-2026-113341 covering Chrome on Android before 156.0.8078.47. This narrows that record’s configuration data; it does not remove the fixes or versions Google announced for other platforms. The update advice remains unchanged.
Finish the update
On desktop, open the page that shows your Chrome version and check for an update. Save your work before any requested restart, then return to read the version number. On Android, use Google Play. Avoid update files offered by an advertisement or a web page pressuring you to install something.
For a device managed by your employer or another organisation, ask the administrator about the bulletin’s versions instead of bypassing an update policy. If you use a different Chromium-based browser, read that browser’s own advisory: a Chrome version number does not establish which release fixes another product.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
- Chrome Releases: Chrome for Android, October 20, 2026 ↗chromereleases.googleblog.com ·
- NVD: CVE-2026-113341, Chrome on Android configuration ↗services.nvd.nist.gov ·
- Chrome Releases: Chrome for iOS, 23 October 2026 ↗chromereleases.googleblog.com ·
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.