Memory Bugs Account for Most of Chrome’s 353 New Security Fixes

Google Chrome version 156.0.8078.47/.48 addresses 353 security flaws, predominantly memory safety vulnerabilities: 163 memory corruption bugs, 125 use-after-free issues, and 17 out-of-bounds reads. Additionally, 36 improper input validation issues were fixed. Among these, six are critical severity (five memory corruption and one use-after-free). The update also resolves 61 high-severity, 197 medium-severity, and 89 low-severity vulnerabilities. No active exploitation has been reported. Bug bounty payments were made for 24 vulnerabilities, with some amounts undisclosed. The update is rolling out for Windows, macOS, and Linux.

The vulnerabilities fixed include critical memory corruption and use-after-free bugs that could potentially allow attackers to execute arbitrary code or cause denial of service if exploited. However, there is no evidence of these vulnerabilities being exploited in the wild at the time of the advisory. The large number of fixes improves the overall security posture of Chrome by addressing a broad range of memory safety and input validation issues.

Users and administrators should update to Chrome version 156.0.8078.47/.48 on their respective platforms as soon as possible to apply the security fixes. Since this is a client software update, remediation requires manual or managed deployment of the new version. No additional mitigation steps are indicated by the vendor.