Chrome 156 Fixes 52 Bugs, Many Found by Claude AI
Chrome 156 patches 52 security flaws, four critical, many found by Anthropic's Claude, which built a sandbox escape. How to update now.
If Chrome is asking you to relaunch, do it today. Google's latest desktop update fixes 52 security bugs, four of them rated critical, and a big share of them were found by an AI model rather than a human hunting through code by hand.
What happened
On October 27, Google pushed Chrome 156.0.8078.73/.74 to the Stable channel for Windows and Mac, with 156.0.8078.73 for Linux. The release notes list 52 security fixes. The four critical ones sit in FileSystem, FileAPI, Layout and Skia, the graphics library Chrome uses to draw pages. Most of the rest are rated high.
Read down the credits and one name keeps coming back: Xinyang Ge of Anthropic, several times marked "assisted by Claude". All four critical bugs carry that name. OpenAI's Codex Security team also has a credit on a high-severity bug in Turbolev, part of Chrome's JavaScript engine.
The same day, Anthropic published a research post explaining what it had been doing. It says an unreleased internal research model, not one you can use in the Claude app, found bugs in Chrome, Safari, Android, Windows and Linux. In Chrome, the model chained four flaws together, starting in the V8 JavaScript engine and ending in FedCM, Chrome's federated sign-in feature. The result ran code outside Chrome's sandbox on a Mac with a default setup, a few seconds after a page loaded. Anthropic says Google has assigned 62 CVEs to its reports, all critical or high, and they're patched as of Chrome 156.
Why it matters
The sandbox is the wall that's meant to stop a bad web page from touching the rest of your computer. Getting past it usually takes a chain of separate bugs, which is why full chains are rare and pricey on the exploit market. An AI model building one from start to finish is a real change in who can do this work and how fast.
The upside is that these bugs went to Google first and are now fixed. The worry is that attackers will get similar tools. Google hasn't said any of these 52 bugs were exploited in the wild, but once patches ship, people can compare old and new code to work out where the holes were. That's why the days after a big update matter.
What to do
- On desktop, open the menu, go to Help, then About Google Chrome. Let it download, then click Relaunch. You want 156.0.8078.73 or later.
- On Android, update Chrome from the Play Store. Google released the same build for Android with matching security fixes.
- Edge, Brave, Opera and Vivaldi are built on Chromium, so keep an eye out for their updates over the next few days.
- If you manage company machines, push the update rather than waiting for the gradual rollout.
It reminds me of the Brotli flaw hitting Node, Bun and Python I covered recently: code almost everyone runs, fixed quietly. Updating your browser takes a minute, so it's an easy win.
Credit to The Hacker News on X, where I first saw the Claude angle on this release.
Comments ()