Google has officially launched Chrome version 156, enhancing its stability by addressing 353 security vulnerabilities. This update primarily targets memory safety issues, of which 163 were memory corruption bugs, 125 were use-after-free problems, and 17 involved out-of-bounds reads. Additionally, 36 vulnerabilities were due to improper input validations.
Critical and High-Severity Vulnerabilities
The latest browser update addresses six critical vulnerabilities. Five of these are linked to memory corruption, while one is a use-after-free bug. Furthermore, Chrome 156 tackles 61 high-severity issues, alongside 197 medium-severity and 89 low-severity weaknesses. Notably, Google has reported no active exploits of these vulnerabilities in the wild.
Bug Bounty and Contributions
In this release, Google has decided against awarding bug bounties for 285 vulnerabilities. These were predominantly identified by Google’s in-house team, Xinyang Ge of Anthropic with assistance from Claude, and OpenAI Codex Security. However, Google has distributed $50,000 in rewards for 24 vulnerabilities, with expectations of higher total payouts as amounts for 44 flaws remain undisclosed.
Among the awarded contributions, Quyen Son from VinFast received the largest single reward of $10,000. This was for detecting a high-severity use-after-free issue in Chrome’s Site Isolation feature.
Availability of Chrome 156
The newly improved Chrome version 156 is now available, with updates rolling out as versions 156.0.8078.47/.48 for Windows and macOS, and 156.0.8078.47 for Linux users. These updates aim to enhance user security and browser performance.
With these substantial security enhancements, Chrome continues to prioritize user safety and performance. As future updates roll out, users can expect further improvements and security measures.
