Google Releases Chrome 156 Fixing 353 Vulnerabilities Including Six Critical Issues
Google has released the latest version of its web browser, Chrome 156, which addresses a total of 353 vulnerabilities tracked under CVE identifiers. Six of these issues are rated Critical, the highest severity level assigned by the company.
The update was published on October 20, 2026, delivering Chrome 156.0.8078.48 and 156.0.8078.47 for Windows and macOS, along with 156.0.8078.47 for Linux. Five of the Critical flaws involve memory corruption vulnerabilities located in the Skia, Accessibility, CSS, Paint, and WebRTC components. These have been assigned the identifiers CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280, and CVE-2026-113303.
The remaining Critical issue, CVE-2026-113271, is a Use-After-Free vulnerability discovered in the Accessibility component. It was reported by Anthropic researcher Xinyang Ge with assistance from Claude. The WebRTC flaw CVE-2026-113303 was reported by OpenAI Codex Security.
Additional severity levels
Sixty-one vulnerabilities were rated High. These affect components including V8, ANGLE, and WebRTC, and include memory corruption, use-after-free conditions, and insufficient input validation. The update also resolves 197 Medium and 89 Low severity issues.
Google plans to roll out the patches gradually over the next several days to weeks across all supported platforms.
Related articles
Why Traditional Vulnerability Scanners Fail in Kubernetes and Cloud Environments
Traditional vulnerability management approaches break down when applied to containers and cloud infrastructure because containers are ephemeral, internal networks are invisible from the outside, and misconfigurations can be introduced at build time. The article highlights the 2018 Tesla Kubernetes incident where an exposed dashboard allowed cryptomining via stolen AWS credentials without any code vulnerabilities. Container security tools are required to scan images during build, enforce policies at deployment, and monitor runtime behavior, unlike classic scanners that only examine running workloads. Key configuration risks include privileged pods, missing NetworkPolicy objects, and overly broad RBAC roles such as cluster-admin. Supply chain protections like Sigstore image signing and SBOM generation are presented as essential for preventing compromised base images and hidden dependencies. Cloud environments add shared responsibility models, dynamic scaling challenges, and regulatory constraints that further limit the effectiveness of legacy VM tools. Specialized platforms such as CNAPP solutions are recommended alongside Russian domestic tools like PT Container Security and Kaspersky Container Security.
Multiple Critical Vulnerabilities Found in PHP, Fixes Scheduled for October 21
The PHP security team has confirmed two serious vulnerabilities in the PHP scripting language. Both issues received a CVSSv4.0 base score of 9.2, placing them in the Critical severity category. The team announced the upcoming security update on October 20, 2026, and plans to release the patched versions at 14:00 UTC on October 21, which corresponds to 23:00 Japan time. Specific technical details, affected components, and vulnerable versions remain undisclosed until the patches are published. The team urges administrators to prepare for immediate updates once the fixes become available. Earlier release is possible if vulnerability details leak or active exploitation is detected.
Mozilla Releases Firefox 158.0.1 Security Update Fixing High-Severity Vulnerabilities and Compromised Certificates
Mozilla Foundation has published Firefox 158.0.1 on October 20, 2026, delivering fixes for four CVEs rated at high overall severity. Two vulnerabilities received a High rating, including a boundary condition flaw in the SVG component tracked as CVE-2026-113399 and a certificate blocklist issue identified as CVE-2026-113470. The update also refreshes the OneCRL list to block an intermediate certificate from eMudhra that was compromised earlier in the month. Mozilla delivered the updated blocklist via RemoteSettings on October 17 and embedded the changes directly into the browser release. This approach ensures compromised certificates remain blocked even when RemoteSettings is disabled or network access is unavailable. One Moderate and one Low severity issue complete the set of addressed flaws.
Drupal Patches Critical Unauthenticated RCE Vulnerability in Field UI Module
The Drupal team has released patches for a critical vulnerability in the Field UI module that can enable remote code execution under specific component combinations. Although the core CMS alone is insufficient for exploitation, at least one known attack path requires no authentication, eliminating the need for an administrator password. The flaw, tracked as CVE-2026-108097, arises when combined with third-party modules or custom site code that exposes vulnerable functionality. Fixes are included in Drupal versions 11.4.10, 11.3.19, and 10.6.19, with temporary mitigation achieved by removing the Field UI module. Drupal Steward provides partial protection against known variants but does not cover all possibilities. A separate RCE issue, CVE-2026-108099, was also fixed in the Entity List module version 3.0.10, which similarly allows unauthenticated exploitation in certain configurations. Prior to the patches, developers warned that exploits could appear within hours or days, though no active attacks have been reported.