In this article
  1. What happened
  2. Why it matters
  3. What to do now
  4. Updates

Vulnerability summary

Per the vendor advisory, Google Chrome Releases: Stable Channel Update for Desktop (Chrome 156, October 27, 2026), checked .

CVE
CVE-2026-118306, CVE-2026-118331, CVE-2026-118348, CVE-2026-118344
Exploited?
Not known. Google's release post does not say any of the 52 flaws is being exploited, and none of the four Critical CVEs is in CISA's Known Exploited Vulnerabilities catalog as of October 28, 2026 (catalog version 2026.10.27). The Critical ratings are Chromium's own severity ratings.

Who is affected and what fixes it

Who is affected and what fixes it, per the vendor advisory
ProductAffectedFixed inSource
Google Chrome for Windows and MacVersions before 156.0.8078.73156.0.8078.73/.74Google, checked
Google Chrome for LinuxVersions before 156.0.8078.73156.0.8078.73Google, checked
Chrome for AndroidVersions before 156.0.8078.73156.0.8078.73 (Google says Android releases carry the same security fixes as desktop unless noted)Google, checked
Microsoft Edge and other Chromium-based browsersNot confirmed; check with MicrosoftEdge: no fix yet at our check; Microsoft said on October 27 it is working on oneMicrosoft, checked

Patch checklist

  1. On each computer, open Chrome, go to Help > About Google Chrome, let it download the update and select Relaunch. Check that the version reads 156.0.8078.73 or later (.74 is also current on Windows and Mac).
  2. Google says the update rolls out "over the coming days/weeks", so our advice is not to wait for it to arrive on its own: check every machine now.
  3. If you manage Chrome for a team, our advice: use your management console's version report to find browsers below 156.0.8078.73, and use the RelaunchNotification policy to prompt or require a relaunch.
  4. Update Chrome on Android phones from Google Play; Google says Chrome 156 for Android reaches Play over the next few days.

If you can't update yet

  • Our advice: until a browser is updated, avoid opening links from unknown senders in it and use an updated browser for anything sensitive. That lowers the risk; it doesn't fix the flaws.
  • Our advice: for Microsoft Edge, Brave and other Chromium-based browsers, and for desktop apps built on Electron, install each vendor's next security update as soon as it appears; they ship their own copy of Chromium and don't get Google's Chrome update.

How to check for compromise

Not confirmed, check the vendor advisory.

Full steps and context: What to do now

TL;DR: Google has released Chrome 156 to the Stable channel with 52 security fixes, four of them rated Critical (CVE-2026-118306, CVE-2026-118331, CVE-2026-118348 and CVE-2026-118344). The fixed versions are 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux. Google doesn’t say any of them is being exploited, but the update rolls out slowly, so check and relaunch Chrome on every work computer now rather than waiting.

What happened

In a Chrome Releases post dated Tuesday, October 27, 2026, Google said the Stable channel “has been updated to 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 to Linux”, rolling out “over the coming days/weeks”. The update includes 52 security fixes: by our count of Google’s list, 4 rated Critical, 46 High and 2 Medium.

The four Critical flaws, as Google describes them:

  • CVE-2026-118306: memory corruption in FileSystem
  • CVE-2026-118331: improper input validation in FileAPI
  • CVE-2026-118348: improper input validation in Skia, Chrome’s graphics library
  • CVE-2026-118344: use after free in Layout

NVD’s records, published October 28 between 7:16 and 7:17 a.m. Manila time, say a remote attacker could use a crafted HTML page to run code: inside Chrome’s sandbox for three of them, and outside the sandbox for CVE-2026-118306. Google is keeping bug details restricted “until a majority of users are updated with a fix.”

All four Critical bugs are credited to Xinyang Ge; Google’s list credits two of them to “Xinyang Ge (Anthropic), assisted by Claude”. Four High-rated bugs are credited to OpenAI Codex Security. Google also released Chrome 156.0.8078.73 for Android on the same day, which it says carries the same security fixes as the desktop release unless otherwise noted.

Microsoft’s Edge security release notes said on October 27 that Microsoft “is aware of the recent Chromium security fixes” and is “actively working on releasing a security fix.” The latest Edge Stable listed there at our check was 156.0.4314.42, released October 22, before Google’s update.

Why it matters

Your browser is where staff open email links, invoices and shared documents, so a browser flaw that runs code from a web page is a direct route onto a work computer. A flaw that reaches outside the sandbox, as NVD describes CVE-2026-118306, is the most serious kind, because the sandbox is what normally contains a compromised page.

Two things make this easy to miss in a small business. Chrome normally applies an update when the browser is closed and reopened, so people who keep it open for days can sit on a pending update. And Google’s rollout runs over days or weeks, so a machine may not even be offered the update yet unless someone checks. Other Chromium-based browsers and apps carry their own copy of Chromium and get these fixes only when their makers ship them: Brave’s latest desktop release (v1.97.57, October 14) is on Chromium 155.0.8059.80, and Electron’s newest release (45.1.0, October 27) bundles Chromium 156.0.8078.49, both below Google’s fixed version.

What to do now

  1. Update and relaunch Chrome everywhere. On each computer, open Help > About Google Chrome, let it update and select Relaunch. You want 156.0.8078.73 or later (156.0.8078.74 is also current on Windows and Mac).
  2. Don’t wait for the rollout. Our advice: check every machine today; opening the About page triggers the update check.
  3. If you manage a fleet, enforce it. Our advice: use your management console to find browsers below 156.0.8078.73, and set Google’s RelaunchNotification policy to prompt or require a relaunch.
  4. Update Android phones through Google Play.
  5. Watch Edge, Brave and Electron apps. Our advice: install their next security updates as soon as they appear; Microsoft says an Edge fix is in progress.

Browsers also had to catch up with this month’s compromised eMudhra certificates: see what to update for eMudhra. Our Security hub tracks the rest.

Updates

  • Oct 28, 2026, 7:05 p.m. Manila: First published. No attacks are reported; we’ll add a dated note when Microsoft ships its Edge fix or if exploitation is reported.

Sources & method

Sources

Method. Checked October 28, 2026, at 4:05 p.m. Manila time (08:05 UTC). Version numbers, CVE IDs, severities, credits and the rollout wording come from Google’s release posts; the severity counts are our count of Google’s list; the “inside/outside the sandbox” detail and NVD publication time come from the NVD records; the Edge status comes from Microsoft’s release notes. We checked CISA’s Known Exploited Vulnerabilities catalog. Steps labelled “our advice” are our own judgment, not Google’s or Microsoft’s. The thumbnail is our screenshot of Google’s release post. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.