Google Chrome 156 Rolls Out Massive Security Patch

Google officially launched Chrome 156, delivering one of its most extensive security patch collections to date. Simultaneously, the company implemented stricter rules for navigating unsecured websites. This latest browser iteration completely resolves 353 distinct vulnerabilities, which crucially include six critical flaws. In parallel, Chrome now proactively warns users by default before establishing connections to HTTP sites. This protocol notoriously permits malicious actors to intercept and manipulate transmitted data.

Extensive Vulnerability Resolutions

The comprehensive October 20 update eradicated errors across dozens of fundamental browser components. Specifically, version 156.0.8078.47 targets Linux systems. Meanwhile, builds 156.0.8078.47 and 156.0.8078.48 actively distribute to Windows and macOS environments. Google systematically deploys these crucial fixes gradually over several days and weeks. Notably, the sheer scale of this update significantly exceeded the September package, which previously addressed 108 vulnerabilities.

Critical Flaws Addressed

Among the critical problems, CVE-2026-113303 stands out prominently within the WebRTC component. This specific component governs real-time audio and video transmission. Memory corruption potentially enables an attacker to execute arbitrary code within the isolated browser sandbox. They can achieve this by utilizing a specially crafted HTML page. Consequently, Google assigned this severe error a critical danger level, carrying a CVSS 3.1 score of 8.8.

Another critical vulnerability, identified as CVE-2026-113279, directly impacts the Accessibility subsystem. This subsystem ensures proper interface accessibility. This particular flaw also permits arbitrary code execution inside the sandbox when a user visits a malicious page. It also carries a CVSS 3.1 score of 8.8. Furthermore, other critical defects compromise Skia, CSS, Paint, and Accessibility functions. Currently, Google has not reported any confirmed instances of active exploitation regarding these listed problems.

Stricter HTTP Warning Implementations

A separate, vital modification involves the robust protection of network connections. On October 21, the Chrome team publicly announced the activation of warnings prior to insecure HTTP connections. This crucial feature now applies to all users by default. Previously, the browser predominantly flagged such pages as insecure only after they had fully opened. Now, Chrome proactively requests explicit permission before establishing the connection. This empowers users to completely refuse data transmission without proper encryption.

Exceptions and User Experience

This distinct warning materializes during the initial visit to an HTTP site. Following explicit permission, the browser refrains from repeating the request, provided the user continues to access the resource regularly. However, if the site remains unvisited for a minimum of two weeks, the warning may reappear. The developers thoughtfully provisioned exceptions for local IP addresses and internal names, such as intranet. These specific resources frequently lack support for public HTTPS certificates and facilitate access to local routers.

Google confidently anticipates that these new warnings will not become a constant irritant. Initial implementation data revealed that nearly 95% of desktop Chrome users encounter zero HTTP warnings over a typical week. Furthermore, less than 1% observe three or more warnings. The transition to mandatory confirmation became feasible primarily due to the widespread global adoption of HTTPS. Importantly, the browser does not permanently block HTTP connections. It always retains the manual option to proceed with the connection if necessary.