Chrome 156.0.8078.73/.74 (27 Oct): 52 security fixes including four Critical bugs in FileSystem, FileAPI, Skia and Layout; two of the Critical bugs credited to an Anthropic researcher assisted by Claude; no exploitation noted
Google's Chrome Releases blog says the Stable channel was updated on 27 October 2026 to 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux, rolling out over the coming days and weeks, with 52 security fixes: four Critical, 46 High and two Medium. The Critical bugs are CVE-2026-118306 (memory corruption in FileSystem) and CVE-2026-118331 (improper input validation in FileAPI), both reported by Xinyang Ge (Anthropic), assisted by Claude, and CVE-2026-118348 (improper input validation in Skia) and CVE-2026-118344 (use-after-free in Layout), both reported by Xinyang Ge.
High-rated fixes include use-after-free and memory-corruption bugs in V8, Turbolev, ANGLE, Skia, PDFium, SVG, Media and FileSystem; Google is credited with 19 of the 52 bugs, and four High bugs are credited to OpenAI Codex Security. Google does not say any of the flaws is exploited and does not publish CVSS scores; bug details stay restricted until most users have updated. Chrome 156.0.8078.73 for Android, released the same day, carries the same security fixes as desktop.
This follows the Chrome 156 Stable release (156.0.8078.47/.48, 20 October), which is a separate card. Primary: Chrome Releases (27 Oct 2026).
- Product
- Google Chrome desktop (Windows, Mac, Linux) and Chrome for Android
- Versions
- Fixed: Chrome 156.0.8078.73/.74 (Windows, Mac), 156.0.8078.73 (Linux, Android). Earlier builds are affected.
- CVSS
- not published by Google; four flaws rated Critical by Chrome
- Exploited in Australia?
- unknown
- Patch to
- Update Chrome to 156.0.8078.73 or later and relaunch the browser (Android: 156.0.8078.73 from Google Play). Managed fleets: confirm the update has applied and users have restarted, and watch for matching Edge, Brave, Opera and Electron releases built on Chromium 156.