The Pulse
Chrome 156 Patches 52 Security Issues; Six Reports Credit Claude Assistance
Google’s Chrome 156 update includes 52 security fixes across Windows, Mac and Linux, including four Critical and 46 High-severity issues. The release credits researcher Xinyang Ge with six reports assisted by Claude, including a High-severi
AI.info Team · Written with AI · fact-checked ·
Google released Chrome 156 security updates on Tuesday, October 27, with 52 fixes for Windows, Mac and Linux. The release notes credit researcher Xinyang Ge with six bug reports assisted by Anthropic’s Claude, including two flaws Google rated Critical. The update is version 156.0.8078.73/.74 for Windows and Mac, and 156.0.8078.73 for Linux; Google says it will roll out over the coming days and weeks.
“This update includes 52 security fixes.”
— Srinivas Sista, Chrome Releases author, Google Chrome
Chrome Releases author Srinivas Sista, listed with Google Chrome, writes that the update includes 52 security fixes. The notice groups the reported issues by severity: four Critical, 46 High and two Medium. It lists each issue’s component and, where provided, its CVE identifier and reporter. Google does not provide a single account of how the flaws could be exploited.
Two Claude-assisted reports concern Critical flaws
Google’s release notice lists four Critical vulnerabilities. CVE-2026-118306 is memory corruption in FileSystem, and CVE-2026-118331 is improper input validation in FileAPI. Google credits Ge, identified as being with Anthropic and assisted by Claude, with reporting both.
The other two Critical reports came from Ge as well, but Google’s notes do not say Claude assisted with them. CVE-2026-118348 concerns improper input validation in Skia, while CVE-2026-118344 is a use-after-free bug in Layout. Keeping those distinctions matters: the release attributes six reports to work assisted by Claude, not all of Ge’s findings.
The 52 fixes span browser components
The release lists fixes across browser systems including FileSystem, V8, Skia, WebRTC, Video, WebAudio and PDFium. The reported issue types also include improper access control, missing authorization, out-of-bounds writing and use-after-free, alongside memory corruption and improper input validation. The notice gives no additional technical explanation for these entries.
Ge’s six Claude-assisted reports cover more than the two Critical findings. The High-severity entries credited to Ge with Claude’s assistance are CVE-2026-118339, a use-after-free in Animation; CVE-2026-118333, missing authorization in Video; CVE-2026-118358, memory corruption in WebAudio; and CVE-2026-118349, memory corruption in Payments. Together with the FileSystem and FileAPI Critical reports, these make six entries explicitly marked as assisted by Claude.
Google also credits other external researchers, Mozilla, OpenAI Codex Security and its own teams for reports in the update. The notice identifies four High-severity issues reported by OpenAI Codex Security: CVE-2026-118350, a use-after-free in Turbolev; CVE-2026-118334, a use-after-free in ImageCapture; CVE-2026-118313, a use-after-free in Video; and CVE-2026-118345, a use-after-free in PDFium. The release attributes these reports to Codex Security, rather than to Claude.
Google is holding back some bug details
The release note warns that access to details and links may remain restricted until a majority of users have received the fix. Google says it may also keep information restricted when a flaw affects a third-party library that other projects depend on but have not yet fixed. As a result, some entries provide severity, component and reporter information without a public explanation of the underlying issue.
Google says the desktop build will roll out over the coming days and weeks. Users can check Chrome’s update settings to see whether the new version is available for their device. The notice identifies the two Critical findings credited to Ge with Claude’s assistance as a FileSystem memory-corruption issue and a FileAPI input-validation issue; it does not publish further details about either vulnerability.