Google releases Chrome 156 stable security update fixing 52 flaws, including critical bugs
CRITICAL · PATCHAnthropicredteam/daily · 1 source
- Severity
- Critical
- Highest CVSS
- 9.6
- Exploited
- Not known
- Sources
- 1
What happened
Chrome Stable 156.0.8078.73/.74 (Windows, macOS) and 156.0.8078.73 (Linux) fixes 52 security issues, including critical CVE-2026-118306 (memory corruption in FileSystem), CVE-2026-118331 (improper input validation in FileAPI), CVE-2026-118348 (Skia) and CVE-2026-118344 (use after free in Layout). ChromeOS 16836.30.0 (Browser 156.0.8078.77) lists high and critical fixes including CVE-2026-118331. Defenders should deploy the update across Chrome and ChromeOS fleets, as Google restricts bug details until most users are patched.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Update Google Chrome to 156.0.8078.73 or later (fixes CVE-2026-118305).
- Update Google Chrome to 156.0.8078.73 or later (fixes CVE-2026-118306).
- Check whether you use Google Chrome: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
- CVE-2026-118340CVSS 9.6Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118312CVSS 9.6Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-118305CVSS 9.6Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118308CVSS 9.6Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118309CVSS 9.6Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118316CVSS 9.6Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118332CVSS 9.6Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118306CVSS 9.6Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- CVE-2026-118321CVSS 9.6Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118310CVSS 9.6Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118355CVSS 9.6Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118342CVSS 9.6Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118333CVSS 9.3Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118337CVSS 9.3Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118335CVSS 8.8Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118336CVSS 8.8Improper input validation in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118338CVSS 8.8Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-118339CVSS 8.8Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118359CVSS 8.8Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118307CVSS 8.8Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118311CVSS 8.8Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118313CVSS 8.8Use after free in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118314CVSS 8.8Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118315CVSS 8.8Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118317CVSS 8.8Memory corruption in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118320CVSS 8.8Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118327CVSS 8.8Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118328CVSS 8.8Improper input validation in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118329CVSS 8.8Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118330CVSS 8.8Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118331CVSS 8.8Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- CVE-2026-118334CVSS 8.8Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118357CVSS 8.8Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118358CVSS 8.8Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118304CVSS 8.8Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118341CVSS 8.8Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118343CVSS 8.8Improper input validation in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118344CVSS 8.8Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- CVE-2026-118346CVSS 8.8Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118347CVSS 8.8Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118348CVSS 8.8Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- CVE-2026-118349CVSS 8.8Memory corruption in Payments in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118350CVSS 8.8Use after free in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118351CVSS 8.8Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118352CVSS 8.8Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118353CVSS 8.8Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118354CVSS 8.8Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118356CVSS 8.8Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118322CVSS 4.3Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118318CVSS 4.3Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-118319CVSS 4.3Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Full story timeline · 59 updates
- Tue 20 OctoberStable Channel Update for DesktopChrome Releases
- Wed 21 OctoberStable Channel Update for ChromeOS / ChromeOS FlexChrome Releases
- Dev Channel Update for ChromeOS / ChromeOS FlexChrome Releases
- Fri 23 OctoberBeta Channel Update for ChromeOS / ChromeOS FlexChrome Releases
- Tue 27 OctoberBeta Channel Update for ChromeOS / ChromeOS FlexChrome Releases
- Stable Channel Update for DesktopChrome Releases
- CVE-2026-118304 published, CVSS 8.8NVD
- CVE-2026-118305 published, CVSS 9.6NVD
- CVE-2026-118306 published, CVSS 9.6NVD
- CVE-2026-118307 published, CVSS 8.8NVD
- CVE-2026-118308 published, CVSS 9.6NVD
- CVE-2026-118309 published, CVSS 9.6NVD
- CVE-2026-118310 published, CVSS 9.6NVD
- CVE-2026-118311 published, CVSS 8.8NVD
- CVE-2026-118312 published, CVSS 9.6NVD
- CVE-2026-118313 published, CVSS 8.8NVD
- CVE-2026-118314 published, CVSS 8.8NVD
- CVE-2026-118315 published, CVSS 8.8NVD
- CVE-2026-118316 published, CVSS 9.6NVD
- CVE-2026-118317 published, CVSS 8.8NVD
- CVE-2026-118318 published, CVSS 4.3NVD
- CVE-2026-118319 published, CVSS 4.3NVD
- CVE-2026-118320 published, CVSS 8.8NVD
- CVE-2026-118321 published, CVSS 9.6NVD
- CVE-2026-118322 published, CVSS 4.3NVD
- CVE-2026-118327 published, CVSS 8.8NVD
- CVE-2026-118328 published, CVSS 8.8NVD
- CVE-2026-118329 published, CVSS 8.8NVD
- CVE-2026-118330 published, CVSS 8.8NVD
- CVE-2026-118331 published, CVSS 8.8NVD
- CVE-2026-118332 published, CVSS 9.6NVD
- CVE-2026-118333 published, CVSS 9.3NVD
- CVE-2026-118334 published, CVSS 8.8NVD
- CVE-2026-118335 published, CVSS 8.8NVD
- CVE-2026-118336 published, CVSS 8.8NVD
- CVE-2026-118337 published, CVSS 9.3NVD
- CVE-2026-118338 published, CVSS 8.8NVD
- CVE-2026-118339 published, CVSS 8.8NVD
- CVE-2026-118340 published, CVSS 9.6NVD
- CVE-2026-118341 published, CVSS 8.8NVD
- CVE-2026-118342 published, CVSS 9.6NVD
- CVE-2026-118343 published, CVSS 8.8NVD
- CVE-2026-118344 published, CVSS 8.8NVD
- CVE-2026-118346 published, CVSS 8.8NVD
- CVE-2026-118347 published, CVSS 8.8NVD
- CVE-2026-118348 published, CVSS 8.8NVD
- CVE-2026-118349 published, CVSS 8.8NVD
- CVE-2026-118350 published, CVSS 8.8NVD
- CVE-2026-118351 published, CVSS 8.8NVD
- CVE-2026-118352 published, CVSS 8.8NVD
- CVE-2026-118353 published, CVSS 8.8NVD
- CVE-2026-118354 published, CVSS 8.8NVD
- CVE-2026-118355 published, CVSS 9.6NVD
- CVE-2026-118356 published, CVSS 8.8NVD
- CVE-2026-118357 published, CVSS 8.8NVD
- CVE-2026-118358 published, CVSS 8.8NVD
- CVE-2026-118359 published, CVSS 8.8NVD
- Wed 28 OctoberStable Channel Update for ChromeOS / ChromeOS FlexChrome Releases
- Fri 30 OctoberDev Channel Update for ChromeOS / ChromeOS FlexChrome Releases
Who reported · 1 outlet
Chrome Releases
Who and what is in it
Products