Google rolled out Chrome 156 to the Stable and Extended Stable channels on October 29, 2026, closing out 21 security issues across Windows, Mac, and Linux. One of them, CVE-2026-76024, a memory corruption bug in the browser’s MediaStream component, is rated Critical. The other 20 are mostly High-severity memory safety bugs scattered across FileSystem, V8, Skia, and a handful of other subsystems, plus one Medium-severity issue. The fix ships through Chrome’s normal auto-update process, so most people just need to restart the browser to pick it up.
What Changed in the Chrome 156 Security Update
The update brings the desktop build to version 156.0.8078.79/.80 on Windows and Mac, and 156.0.8078.79 on Linux, according to Google’s own Chrome Releases blog post. Of the 21 fixes, 1 is Critical, 19 are High, and 1 is Medium. The Critical bug, CVE-2026-76024, is a use-after-free-style memory corruption flaw in MediaStream, the API that handles webcam and microphone capture for things like video calls and screen sharing. It was reported internally by Google researcher Xinyang Ge on October 21.
Most of the High-severity bugs follow a familiar pattern for Chrome security releases: use-after-free and memory corruption issues in components like FileSystem, CacheStorage, Quota, DOM, and the Blink rendering engine, several of them flagged by Google’s own security team and a few credited to outside researchers. As usual, Google is withholding technical detail on the bugs until most users have updated, and some entries are also restricted because the underlying code is shared with other open source projects that haven’t patched yet.
Who Should Care and What to Do
This affects effectively anyone running desktop Chrome, which also covers most Chromium-based browsers (Edge, Brave, Opera, Vivaldi) once they pull in the same patch on their own release schedule. A Critical memory corruption bug in MediaStream is the kind of flaw that, once researchers reverse-engineer the fix, tends to get turned into a proof-of-concept exploit targeting sites that use webcam or screen-share APIs, which is most video conferencing tools and plenty of ordinary web apps.
Chrome updates itself in the background, but the fix only takes effect after a restart. Check your version at chrome://settings/help; anything at 156.0.8078.79 or later on Windows and Linux, or .80 on Mac, is covered. If you manage client sites and log into WordPress or Webflow dashboards through Chrome, an unpatched browser is one more way an admin session can be compromised that has nothing to do with the CMS itself, so this is worth rolling into whatever monthly patch routine already covers OS and third-party software updates.
This follows the same cadence as last month’s Chrome 155 update, which patched 247 flaws. Chrome’s release train moves fast enough that staying current is really the only practical defense most people have against this class of bug.
