Chrome 156 Notes Credit Xinyang Ge on All Four Critical Fixes

Google's Oct. 27 Chrome 156 release notes credit Xinyang Ge on all four Critical fixes and on 16 of the 52 security entries, and a second note two days later credits Ge or a handle spelled "xinyang" on four more. The fixed builds are 156.0.8078.73 and later.

The credit lines matter because Anthropic's Frontier Red Team said in an Oct. 27 post that its Chrome findings cover 62 CVEs, all rated Critical or High. Google's two notes credit Ge or "xinyang" on 20 entries between them and do not say how that relates to 62.

What the Oct. 27 note credits

The Oct. 27 Stable update moved Windows and Mac to 156.0.8078.73 and .74 and Linux to 156.0.8078.73. It lists 52 entries: four Critical, 46 High and two Medium. Ge is credited on all four Critical entries: CVE-2026-118306 (use after free in FileSystem), CVE-2026-118331 (FileAPI), CVE-2026-118348 (integer overflow in Skia) and CVE-2026-118344 (Layout).

Six of Ge's 16 credits read "Xinyang Ge (Anthropic), assisted by Claude." The other 10 name Ge alone. Two more entries, CVE-2026-118353 and CVE-2026-118327, are credited to "Anthropic and Ada Logics" and are authorization bugs in Paint and Media.

1. Google20 entries
2. Xinyang Ge16 entries
3. Other outside researchers10 entries
4. OpenAI Codex Security4 entries
5. Anthropic and Ada Logics2 entries

Source: Chrome Releases, Stable Channel Update for Desktop, Oct. 27, 2026, accessed 2026-11-04

OpenAI's tool also appears. OpenAI Codex Security is credited on four entries, under the handles amyb (one entry, reported Sept. 28) and kylebot (three, reported Oct. 15).

Report dates against the fix date

Every entry carries the date it was reported. Ge's Claude-assisted credits are dated Sept. 30, Oct. 7, Oct. 10 and Oct. 11, so those fixes shipped 16 to 27 days later. The unassisted Ge credits run from Sept. 16 to Oct. 21, a spread of 6 to 41 days. Anthropic's post describes a policy of 90 days to patch, so Chrome was well inside it.

Note	Builds	Entries	Critical	Credits naming Ge
Oct. 27	156.0.8078.73/.74	52	4	16
Oct. 29	156.0.8078.79/.80	21	1	4

What the credit lines cannot show

The notes do not say which model found a bug. Only the six "assisted by Claude" lines name a tool, and Anthropic's post says its work used "an unreleased, internal research model." Ten Ge credits give no tool at all, so the notes cannot support a count of model-found Chrome bugs.

The 62 figure also cannot be checked from these two notes. An earlier Stable note for 155.0.8059.84 credits Ge on five more entries, and a Nov. 3 Stable note credits Vlad Stolyarov (Anthropic), assisted by Claude. The credits are spread across several releases, and this article did not total them.

The earlier coverage of Anthropic's five exploit chains repeated the 62 figure from the post. Google's notes are the document that would confirm it, entry by entry. OpenAI made a parallel claim about PHP2Shell, covered in a piece on who found that bug first.

Chrome users should update to 156.0.8078.79 or later, the Oct. 29 build, which Google released to Stable and Extended Stable. The Oct. 27 note lists reward amounts as "TBD".