- SecurityWeek reports that Chrome 156 fixes 353 vulnerabilities, six of them critical. Most are memory safety errors. SecurityWeek notes that Google's advisory does not mention exploitation in the wild.
- Per SecurityWeek, Google's advisory pays no bounty for 285 flaws. Google found 266. Anthropic's Xinyang Ge (assisted by Claude) or OpenAI Codex Security found the rest.
- Leaders should confirm that managed browsers have reached version 156.0.8078.47 or later and measure how long updates take to arrive.
A patch count tells you who is looking
A browser update with 353 security fixes sounds like a product in trouble. The number says as much about who is searching for flaws as about how many exist. Chrome 156 is a useful case, because the credits include AI-assisted finders alongside Google's own team.
SecurityWeek reported on Tuesday's release, citing Google's advisory. According to SecurityWeek, the advisory says no bounty will be paid for 285 of the vulnerabilities. Google itself found 266 of them. The remaining flaws were credited to Xinyang Ge of Anthropic, assisted by Claude, or to OpenAI Codex Security.
That raises a question rather than answering one. The reporting does not say how much of the work those finders did. It also does not say whether any of Google's 266 finds involved AI tools. One release cannot show a trend.
What was fixed
Memory errors make up the bulk. By SecurityWeek's tally, that means 163 cases of corrupted memory, 125 cases of freed memory being used again, and 17 reads beyond the edge of a data block. Together these total 305 of the 353. SecurityWeek says a further 36 are improper input validation, meaning weak checks on data the browser receives.
Six of the flaws are rated critical. Five of those are memory corruption and one is a use-after-free. The release also fixes 61 high, 197 medium and 89 low severity issues.
SecurityWeek notes that Google makes no mention of exploitation in the wild. A missing mention is not proof either way.
How memory bugs work
Software keeps data in blocks of computer memory. A use-after-free happens when a program releases a block, then keeps using it. By then the block may hold something else, and an attacker can sometimes steer what it holds.
An out-of-bounds read is similar. The program reads past the edge of the space it was given and sees data it should not. Memory corruption is the general case, where data is overwritten in ways the programmer never intended.
These are flaws in how a program manages its own memory. They are not mistakes a user can make. That is why the fix is a software update, and why the update's reach matters.
Who is paid, and who is not
Google says it paid $50,000 in bounties for 24 of the vulnerabilities, per SecurityWeek. SecurityWeek adds that the final total will probably be higher, because Google has not disclosed amounts for 44 flaws. The highest single reward was $10,000, to Quyen Son of VinFast, for a high-severity use-after-free in Site Isolation.
The lesson here is about what bounty figures can show. In this release, 285 of the 353 fixes earn no payout. Bounty totals therefore cover only part of the work behind a release. They say little about how much scrutiny a product receives.
What leaders should ask
SecurityWeek says the release is rolling out as 156.0.8078.47 and .48 for Windows and macOS, and 156.0.8078.47 for Linux. The advisory does not mention exploitation in the wild, but it fixes six critical flaws. Confirming your fleet's version quickly is therefore reasonable. It is also a good moment to test your process.
Ask your IT team three questions. How many managed devices run Chrome 156 today? How many days does a stable-channel release take to reach most of your fleet? And which devices, such as shared kiosks or contractor laptops, sit outside that process?
Also ask whether your own software suppliers use AI-assisted review on their code, and what they do with the results. This release credits AI-assisted finders next to Google's own team. It does not show how large their contribution was.
A browser is the software through which staff reach most web apps, email and documents. Treat its update speed as a measure of your risk, not as an IT chore.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Google (Chrome Releases blog).
