Skip to content
audiotale.net
Sign in
NewsNews

Chrome 156.0.8078.73 fixes 52 security flaws, 4 Critical: update now

Google's 27 October Chrome 156 update patches 52 vulnerabilities, including four Critical ones in FileSystem, FileAPI, Skia and Layout; here is how to check your version.

audiotale.net team

· 6 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. The numbers
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

Google shipped a second security build of Chrome 156 on 27 October 2026: version 156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux and Android. The release notes list 52 security fixes, four of them rated Critical, and the build is rolling out "over the coming days/weeks", so many browsers will not have it yet. For most people the action is simple: open Chrome's About page, let it update, and restart the browser.

Key points

  • Chrome 156.0.8078.73/.74 (Windows, Mac) and 156.0.8078.73 (Linux) went to the Stable channel on 27 October 2026 with 52 security fixes, according to Google's release notes.
  • Four fixes are rated Critical: CVE-2026-118306 (FileSystem), CVE-2026-118331 (FileAPI), CVE-2026-118348 (Skia) and CVE-2026-118344 (Layout). Forty-six are High and two are Medium.
  • Google's post does not say any of the bugs are being exploited, and it keeps bug details restricted until most users have updated.
  • Sixteen of the 52 entries credit researcher Xinyang Ge, and six of those name Anthropic and Claude as an assistant; four more entries credit OpenAI Codex Security.
  • Chrome for Android 156.0.8078.73 carries the same security fixes and reaches Google Play "over the next few days".

What to do

  • Check your version. In Chrome open the menu, then Help, then About Google Chrome (or go to chrome://settings/help). Chrome checks for the update and downloads it. Click Relaunch to finish. A browser that has been open for days is not protected until it restarts.
  • Target version. You want 156.0.8078.73 or .74 on Windows and Mac, and 156.0.8078.73 on Linux. On Android the same number applies, but the update appears in Google Play over several days.
  • Managed fleets. Administrators who pin Chrome versions should move the Stable channel to 156.0.8078.73 or later. Chromium-based browsers (Edge, Brave, Opera, Vivaldi and others) ship their own builds on their own schedules, so check each vendor's release notes rather than assuming the same day.
  • No workaround. Google's post offers none. The fix is the update itself.
  • Are you affected? Any build older than 156.0.8078.73 does not have these fixes. Google's post does not say which earlier versions each bug affects, so use the version number as your test.

What happened

Google's Chrome Releases blog published the Stable Channel Update for Desktop on Tuesday 27 October 2026. It states that the Stable channel "has been updated to 156.0.8078.73/.74" for Windows and Mac and 156.0.8078.73 for Linux, and that it includes 52 security fixes. A separate post the same day says Chrome 156 (156.0.8078.73) is coming to Android and that Android releases contain the same security fixes as the matching desktop release unless noted.

The entries are listed by severity. By our count of the published list there are four Critical, 46 High and two Medium fixes, which adds to 52. The Critical ones are:

  • CVE-2026-118306: memory corruption in FileSystem, reported by Xinyang Ge (Anthropic), assisted by Claude, on 7 October.
  • CVE-2026-118331: improper input validation in FileAPI, reported by Xinyang Ge (Anthropic), assisted by Claude, on 11 October.
  • CVE-2026-118348: improper input validation in Skia, reported by Xinyang Ge on 17 October.
  • CVE-2026-118344: use after free in Layout, reported by Xinyang Ge on 17 October.

The High entries span a wide range of components. Skia has the most entries overall (five), followed by V8, Chrome's JavaScript engine (four), then FileSystem, Paint and SVG (three each). Other components named include WebRTC, ANGLE, WebAudio, PDFium, Media and Payments. Of the 52 entries, the bracketed field at the start of each entry (where Google normally shows the bounty) reads "N/A" for 39 and "TBD" for 13, so no reward amounts are shown for this build yet.

One outside outlet, Quest Review Center, reports that vulnerability databases describe CVE-2026-118306 as allowing a remote attacker to run code outside Chrome's sandbox through a crafted HTML page. We could not find that statement in Google's own post, which gives only the component and bug type, so treat it as unconfirmed.

Background

This is the second large Chrome 156 security build in a week. Google promoted Chrome 156 to Stable on 20 October 2026, with 353 security fixes, six of them rated Critical, according to Cybersecuritynews, which cites Google's advisory. The versions then were 156.0.8078.47 for Linux and 156.0.8078.47/.48 for Windows and Mac. That release credited Xinyang Ge of Anthropic, assisted by Claude, for a Critical Accessibility use-after-free (CVE-2026-113271), and OpenAI Codex Security for a Critical WebRTC bug (CVE-2026-113303).

The same pattern preceded it. Cybersecuritynews notes that earlier in October a Chrome update fixed 247 vulnerabilities and another fixed 37. Two things stand out across these releases: the sheer count of fixes in a single point release, and how many reports now come from AI-assisted research rather than only from human fuzzing and manual review.

The 27 October release is smaller than the 353-fix build, but the Critical entries matter. Chrome's release notes routinely say that access to bug details may be restricted until a majority of users have updated, and that restriction applies here. That is the normal practice, not a sign of active attacks.

The numbers

Who reported what is visible in the credits. Counting the 52 entries by the name attached to each:

Chrome 156.0.8078.73 security fixes by credited reporterfixes
Chrome 156.0.8078.73 security fixes by credited reporter (fixes)
fixes
Google19
Xinyang Ge16
Other researchers11
OpenAI Codex Security4
Anthropic and Ada Logics2

Source: Chrome Releases, Stable Channel Update for Desktop, 27 October 2026 (our count)

Of the 16 entries credited to Ge, six are written "Xinyang Ge (Anthropic), assisted by Claude". The two "Anthropic and Ada Logics" entries (CVE-2026-118353 in Paint and CVE-2026-118327 in Media) are separate. The four OpenAI Codex Security entries are CVE-2026-118350 (Turbolev), CVE-2026-118334 (ImageCapture), CVE-2026-118313 (Video) and CVE-2026-118345 (PDFium); the last three are credited to a researcher listed as kylebot and the first to one listed as amyb.

Severity is heavily weighted towards High:

Chrome 156.0.8078.73 security fixes by severityfixes
Chrome 156.0.8078.73 security fixes by severity (fixes)
fixes
Critical4
High46
Medium2

Source: Chrome Releases, Stable Channel Update for Desktop, 27 October 2026 (our count)

What it means

For everyday users, nothing about this requires action beyond updating and restarting. The practical risk with browser fixes is the gap between the release and the moment each person actually restarts. Chrome's rollout to "the coming days/weeks" means the About page may say you are up to date before the new build reaches you; checking again later in the week is reasonable.

For IT teams, the Critical entries in FileSystem and FileAPI are the ones to prioritise in patch windows, because they sit in web-facing APIs that any page can reach. Google's post does not say how easily they can be exploited, so we cannot rank them beyond the vendor's severity labels.

For the wider industry, the credits are the story behind the story. Sixteen of 52 reports come from one researcher, six explicitly with Claude's help, and four from OpenAI's Codex Security tool. Google's own engineers account for the largest single group (19). Cybersecuritynews cautions that the credits do not show how much of each finding was automated, and we agree: the advisory only records who reported the bug and which tool assisted. It does show that AI-assisted discovery has become routine enough that Chrome's credit lines name the tools.

What we don't know yet

  • Exploitation. Google's post does not mention attacks in the wild for any of the 52 bugs. Whether any are being used is not stated.
  • Severity detail. Only the component and the bug type are public. How far an attacker could get from each Critical bug, for example whether a sandbox escape is possible, is not confirmed by Google.
  • Bounties. The bracketed bounty field reads N/A or TBD on every entry, so payouts for these reports are not shown.
  • Other Chromium browsers. We have not seen release notes from Edge, Brave, Opera or Vivaldi for this build.
  • AI contribution. The extent to which AI tools did the finding versus assisting a human researcher is not described in the advisory.

What to watch next

  • Google usually opens bug details after most users have updated; the Chromium bug tracker entries for the four Critical issues are the ones to look for.
  • Whether Edge and other Chromium-based browsers publish matching builds in the next days.
  • Whether a further Chrome 156 build follows, given that two security builds landed within a week.
  • Whether security notices begin to report in-the-wild exploitation of any of these CVEs. We will add a dated update if a source confirms it.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next