Chrome 156 is out, and the 353 security fixes inside it make this an update worth installing today. Google says six of the bugs are rated critical, so open Chrome, check for the update, and relaunch. You also get a handy voice typing tool and a few developer goodies along the way.
Here are the quick facts before we get into the details:
- Google announced Chrome 156 on October 20, 2026, with build 156.0.8078.47 on desktop.
- It fixes 353 security issues, including six critical ones, according to GBHackers.
- New features include Talk to Type voice dictation, quizzes in Gemini in Chrome, and Chrome launching at Windows sign-in.
- It is rolling out gradually, so you may need to check manually.
That list is the short version. The rest of this post covers what the fixes mean for you and what is worth trying first.
How to get the Chrome 156 update right now
Chrome usually updates itself, but it only applies the new version after a restart. If your browser has been open for days, you could be running the old, vulnerable build without knowing it.
Open the three-dot menu, go to Help, then About Google Chrome. Chrome checks for the Chrome update, downloads it, and shows a Relaunch button. Click it and your tabs come back.
The builds differ slightly by platform, so here is what to look for:
| Platform | Chrome 156 build | Where you get it |
|---|---|---|
| Windows and Mac | 156.0.8078.47 / .48 | Help > About Google Chrome |
| Linux | 156.0.8078.47 | Your package manager or Chrome |
| Android | 156.0.8078.47 | Google Play, rolling out |
| iPhone and iPad | 156.0.8078.46 | App Store, rolling out |
| ChromeOS | 16836.19.0 (browser 156.0.8078.42) | Settings > About ChromeOS |
The platform details come from Chrome Geek. If your version number is lower, the rollout has not reached you yet, so check again in a day or two.
What the 353 security fixes actually cover
Reports based on Google’s release notes break the 353 fixes down as 6 critical, 68 high, 190 medium, and 89 low severity. That is a big batch, even for a browser that now ships updates every couple of weeks.
The six critical bugs are all memory corruption or use-after-free problems. They sit in Skia (graphics), Accessibility, CSS, Paint, and WebRTC. In plain terms, a booby-trapped web page could try to trick the browser into running code it should not.
The high-severity list reaches even further, touching V8, GPU, Site Isolation, password management, PDF, and ServiceWorkers. GBHackers does not say any of these are being exploited in the wild, and Google often keeps bug details private until most people have updated.
That is why the safe move is simple. Treat this as a “do it today” update, even if you do not plan to use a single new feature. We saw the same pattern with our earlier look at the Chrome 155 security update, and the numbers keep climbing.
Talk to Type: dictate into any text box in Chrome 156
The headline feature is Talk to Type. Right-click a text box on a web page, start speaking, and Chrome cleans up and punctuates what you say. You can also highlight text and tell Chrome how to change it, such as “make this shorter.”
After the first use, a shortcut starts it faster: Ctrl + Space on Windows and ChromeOS, or Option + Space on Mac. There are a few conditions to know about:
- You must be signed in to Chrome and allow microphone access.
- It does not work in Incognito windows.
- Text editing by voice does not work in Google Workspace apps yet.
- It is desktop only, and availability varies by country and language.
These limits matter because most people will hit one of them in the first five minutes. If it does not appear for you, the rollout probably has not reached your account yet. Admins can manage it with the VoiceTypingSettings policy. For another take on speech-to-text, see how Google Docs Live turns your voice into a first draft.
Other changes in this Chrome update
Voice typing is not the only addition. These are the changes most people will notice or care about:
| Change | What it does | Who it affects |
|---|---|---|
| Gemini in Chrome quizzes | Turns a page, PDF, slide deck, or YouTube video into an interactive quiz | Students and learners on desktop, in some countries |
| Gemini Spark sign-in sharing | Lets Gemini Spark use saved logins to finish tasks, with your unlock each time | Desktop, ChromeOS, and Android users |
| Launch with Windows | Chrome can start when you sign in to Windows | Windows users, gradual rollout |
| Android auto browse alerts | Shows background task progress as a live notification | Android users |
The Windows startup change is the one some people will want to switch off. Admins can use the LaunchOnStartupEnabled policy, and individual users can adjust it in Windows startup settings. Gemini Spark asking for a fingerprint or face unlock before it touches a saved password is a sensible safeguard.
For web developers, Chrome 156 adds the CSS random() function, a pseudo-class for the element that started a navigation, and retries for failed module loads. New IndexedDB stores also use SQLite, which should cut corruption after crashes. We covered these ahead of time in our Chrome 156 preview.
What admins and developers should check
Not every change is a gift. Chrome 156 removes the LocalNetworkAccessRestrictionsTemporaryOptOut policy, so any setup that relied on it needs another fix. The AutofillAddressEnabled and AutofillCreditCardEnabled policies are also deprecated in favor of AutofillSettings.
The fencedframe element and window.fence APIs now do nothing, and the element is expected to go away in Chrome 157. That version is next up, as we explained in our Chrome 157 guide. If your site or intranet depends on any of this, test before the next release lands.
Frequently Asked Questions
Is Chrome 156 safe to install?
Yes, and skipping it is the riskier choice. The update exists to close 353 security holes, including six critical ones.
Why does my Chrome not show version 156?
Google rolls out updates in stages over days or weeks. Check Help > About Google Chrome again later, or download the installer from Google.
Does Talk to Type work on my phone?
No. It is a desktop feature on Windows, Mac, Linux, and ChromeOS for now.
Are these bugs being attacked right now?
The reports we found do not mention active exploitation. Still, attackers often study patches, so updating quickly is the best defense.
Our take
Update first, play with features second. A 353-fix release is not the time to postpone a relaunch, and it takes under a minute. Once you are done, try Talk to Type on a long email or form; if it works for you, it saves real typing time, but leave Gemini Spark off until you are comfortable with what it can access.
Leave a Reply