Chrome Security Update Fixes 52 Flaws, Including Four Critical Bugs

TL;DR

Google has released Chrome 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux. This Chrome security update fixes 52 vulnerabilities, including four critical Chrome vulnerabilities. One of them could let attackers run code outside the browser sandbox.

Google has not reported any exploitation. Update Chrome now and restart the browser.

Notable CVEs

Why It Matters

Browser bugs are attractive targets, since a single malicious page can trigger them. Notably, 32 of the 52 fixes in this Chrome security update are memory corruption, use-after-free or out-of-bounds write bugs. These bug classes often lead to code execution.

AI tools also played a large role in this release. Xinyang Ge reported 16 flaws, and six of those credits say “assisted by Claude.” OpenAI Codex Security found four more.

How the Attack Works

Critical Chrome vulnerabilities

The most severe bug is CVE-2026-118306, a memory corruption flaw in FileSystem. According to its CVE record, it lets a remote attacker “potentially execute arbitrary code outside the sandbox via a crafted HTML page.”

The other three critical flaws hit FileAPI (CVE-2026-118331), Skia (CVE-2026-118348) and Layout (CVE-2026-118344). Each one could allow code execution inside the sandbox through a malicious web page.

High severity flaws

The 46 high severity bugs cover V8, Turbolev, ANGLE, Skia, PDFium, WebRTC and other components. However, Google keeps most bug details private for now. As its release notes explain, “Access to bug details and links may be kept restricted until a majority of users are updated with a fix.”

Affected Versions

All Chrome versions before 156.0.8078.73 are affected on Windows, Mac and Linux.

Patch and Mitigation

Open the Chrome menu, then go to Help and About Google Chrome. The browser checks for the update and asks you to relaunch. Google says the rollout will continue “over the coming days/weeks.”

So far, no exploitation or public proof-of-concept has been confirmed. None of these flaws appear in CISA’s KEV catalog. Even so, apply this Chrome security update quickly, and update Chromium-based browsers once their vendors ship fixes.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.