Google releases Chrome 156 stable security update fixing 52 flaws, including critical bugs
CRITICAL · PATCHAnthropicredteam/daily · 1 source
- Severity
- Critical
- Highest CVSS
- 9.6
- Exploited
- Not known
- Sources
- 1
What happened
Chrome Stable 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux addresses 52 security issues, several rated critical, including CVE-2026-118331 in FileAPI and CVE-2026-118306 in FileSystem. ChromeOS 16836.30.0 (Browser 156.0.8078.77) is rolling out to Stable devices with its own list of fixes, and Beta and Dev channels have also received ChromeOS 157 builds.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Update Google Chrome to 156.0.8078.73 or later (fixes CVE-2026-118305).
- Update Google Chrome to 156.0.8078.73 or later (fixes CVE-2026-118306).
- Check whether you use Google Chrome: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
- CVE-2026-118340CVSS 9.6Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118312CVSS 9.6Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-118305CVSS 9.6Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118308CVSS 9.6Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118309CVSS 9.6Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118316CVSS 9.6Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118332CVSS 9.6Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118306CVSS 9.6Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- CVE-2026-118321CVSS 9.6Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118310CVSS 9.6Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118355CVSS 9.6Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118342CVSS 9.6Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118333CVSS 9.3Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118337CVSS 9.3Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118335CVSS 8.8Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118336CVSS 8.8Improper input validation in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118338CVSS 8.8Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-118339CVSS 8.8Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118359CVSS 8.8Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118307CVSS 8.8Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118311CVSS 8.8Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118313CVSS 8.8Use after free in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118314CVSS 8.8Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118315CVSS 8.8Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118317CVSS 8.8Memory corruption in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118320CVSS 8.8Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118327CVSS 8.8Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118328CVSS 8.8Improper input validation in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118329CVSS 8.8Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118330CVSS 8.8Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118331CVSS 8.8Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- CVE-2026-118334CVSS 8.8Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118357CVSS 8.8Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118358CVSS 8.8Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118304CVSS 8.8Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118341CVSS 8.8Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118343CVSS 8.8Improper input validation in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118344CVSS 8.8Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- CVE-2026-118346CVSS 8.8Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118347CVSS 8.8Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118348CVSS 8.8Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- CVE-2026-118349CVSS 8.8Memory corruption in Payments in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118350CVSS 8.8Use after free in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118351CVSS 8.8Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118352CVSS 8.8Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118353CVSS 8.8Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118354CVSS 8.8Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118356CVSS 8.8Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118322CVSS 4.3Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118318CVSS 4.3Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118319CVSS 4.3Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Full story timeline · 59 updates
- Tue 20 OctoberStable Channel Update for DesktopChrome Releases
- Wed 21 OctoberStable Channel Update for ChromeOS / ChromeOS FlexChrome Releases
- Dev Channel Update for ChromeOS / ChromeOS FlexChrome Releases
- Fri 23 OctoberBeta Channel Update for ChromeOS / ChromeOS FlexChrome Releases
- Tue 27 OctoberBeta Channel Update for ChromeOS / ChromeOS FlexChrome Releases
- Stable Channel Update for DesktopChrome Releases
- CVE-2026-118304 published, CVSS 8.8NVD
- CVE-2026-118305 published, CVSS 9.6NVD
- CVE-2026-118306 published, CVSS 9.6NVD
- CVE-2026-118307 published, CVSS 8.8NVD
- CVE-2026-118308 published, CVSS 9.6NVD
- CVE-2026-118309 published, CVSS 9.6NVD
- CVE-2026-118310 published, CVSS 9.6NVD
- CVE-2026-118311 published, CVSS 8.8NVD
- CVE-2026-118312 published, CVSS 9.6NVD
- CVE-2026-118313 published, CVSS 8.8NVD
- CVE-2026-118314 published, CVSS 8.8NVD
- CVE-2026-118315 published, CVSS 8.8NVD
- CVE-2026-118316 published, CVSS 9.6NVD
- CVE-2026-118317 published, CVSS 8.8NVD
- CVE-2026-118318 published, CVSS 4.3NVD
- CVE-2026-118319 published, CVSS 4.3NVD
- CVE-2026-118320 published, CVSS 8.8NVD
- CVE-2026-118321 published, CVSS 9.6NVD
- CVE-2026-118322 published, CVSS 4.3NVD
- CVE-2026-118327 published, CVSS 8.8NVD
- CVE-2026-118328 published, CVSS 8.8NVD
- CVE-2026-118329 published, CVSS 8.8NVD
- CVE-2026-118330 published, CVSS 8.8NVD
- CVE-2026-118331 published, CVSS 8.8NVD
- CVE-2026-118332 published, CVSS 9.6NVD
- CVE-2026-118333 published, CVSS 9.3NVD
- CVE-2026-118334 published, CVSS 8.8NVD
- CVE-2026-118335 published, CVSS 8.8NVD
- CVE-2026-118336 published, CVSS 8.8NVD
- CVE-2026-118337 published, CVSS 9.3NVD
- CVE-2026-118338 published, CVSS 8.8NVD
- CVE-2026-118339 published, CVSS 8.8NVD
- CVE-2026-118340 published, CVSS 9.6NVD
- CVE-2026-118341 published, CVSS 8.8NVD
- CVE-2026-118342 published, CVSS 9.6NVD
- CVE-2026-118343 published, CVSS 8.8NVD
- CVE-2026-118344 published, CVSS 8.8NVD
- CVE-2026-118346 published, CVSS 8.8NVD
- CVE-2026-118347 published, CVSS 8.8NVD
- CVE-2026-118348 published, CVSS 8.8NVD
- CVE-2026-118349 published, CVSS 8.8NVD
- CVE-2026-118350 published, CVSS 8.8NVD
- CVE-2026-118351 published, CVSS 8.8NVD
- CVE-2026-118352 published, CVSS 8.8NVD
- CVE-2026-118353 published, CVSS 8.8NVD
- CVE-2026-118354 published, CVSS 8.8NVD
- CVE-2026-118355 published, CVSS 9.6NVD
- CVE-2026-118356 published, CVSS 8.8NVD
- CVE-2026-118357 published, CVSS 8.8NVD
- CVE-2026-118358 published, CVSS 8.8NVD
- CVE-2026-118359 published, CVSS 8.8NVD
- Wed 28 OctoberStable Channel Update for ChromeOS / ChromeOS FlexChrome Releases
- Fri 30 OctoberDev Channel Update for ChromeOS / ChromeOS FlexChrome Releases
Who reported · 1 outlet
Chrome Releases
Who and what is in it
Products