GOOGLE has released Chrome 156 to the stable channel with fixes for 353 security vulnerabilities. Most were memory safety flaws: 163 memory corruption bugs, 125 use-after-free issues and 17 out-of-bounds reads. Another 36 vulnerabilities involved improper input validation. The update addresses six critical-severity flaws—five memory corruption bugs and one use-after-free—as well as 61 high-, 197 medium- and 89 low-severity issues.
Google has not said that any of the vulnerabilities are being exploited in the wild. Its advisory says no bug bounty will be paid for 285 flaws, including 266 found by Google and others identified by Xinyang Ge of Anthropic, with help from Claude, or by OpenAI Codex Security. Google reported paying $50,000 for 24 vulnerabilities, while amounts for another 44 have not been disclosed. The highest stated reward was $10,000, paid to Quyen Son of VinFast for a high-severity use-after-free flaw in Site Isolation.
Chrome 156 is rolling out as versions 156.0.8078.47/.48 for Windows and macOS, and 156.0.8078.47 for Linux.