Red Hot Cyber
Cybersecurity, Cybercrime News and Vulnerability Analysis
Google has released Chrome 156 with one of the largest security fix packages ever released and at the same time has changed the rules for visiting unprotected sites. The new browser version immediately closes 353 vulnerabilities, including six critical ones. In parallel, Chrome has started warning users before connecting to sites via the HTTP protocol, which allows interception and replacement of transmitted data.
The October 20 update removed errors in dozens of browser components. Version 156.0.8078.47 is intended for Linux, while builds 156.0.8078.47 and 156.0.8078.48 are distributed for Windows and macOS. Google releases the fixes gradually over several days and weeks. The scope of the update surpassed the September package, which closed 108 vulnerabilities.
Among the critical issues, CVE-2026-113303 in the WebRTC component stands out, responsible for real‑time audio and video transmission. The memory damage allows an attacker to potentially execute arbitrary code within the browser’s sandboxed environment via a specially crafted HTML page. Google assigned the flaw a critical severity level and a CVSS 3.1 score of 8.8.
Another critical vulnerability, CVE-2026-113279, concerns the Accessibility subsystem, which ensures interface accessibility. The flaw also allows code execution within the sandbox when visiting a malicious page. The CVSS 3.1 score is 8.8. Other critical defects affect Skia, CSS, Paint and Accessibility. Google has not provided any confirmed exploitation cases for the listed issues.
A separate change concerns network connection protection. The Chrome team on October 21 announced the activation of warnings before insecure HTTP connections for all users by default. Previously, the browser mainly indicated such pages as unprotected only after opening them. Now Chrome asks for permission before establishing the connection, allowing users to refuse the transmission of unencrypted data.
The warning appears on the first visit to an HTTP site. After authorization, the browser does not repeat the request as long as the user continues to open the resource regularly. If the site has not been visited for at least two weeks, the warning may reappear. Exceptions are made for local IP addresses and internal names such as intranet. Such resources often do not support public HTTPS certificates and are used to access routers.
Google hopes the new warnings will not become a constant nuisance. Early implementation results showed that almost 95% of desktop Chrome users encounter no HTTP warnings in a week, while less than 1% see three or more. The shift to mandatory confirmation was made possible by the widespread adoption of HTTPS. At the same time, the browser does not permanently block HTTP, leaving the option to continue the connection manually.
