Google Chrome 156: five Critical memory bugs in two updates (CVE-2026-118306, CVE-2026-118331, CVE-2026-118348, CVE-2026-118344, CVE-2026-76024)

What happened

Google shipped two Chrome 156 desktop updates in three days.

27 October 2026: 156.0.8078.73/.74 for Windows and Mac, 156.0.8078.73 for Linux. It has 52 security fixes, four of them Critical (Chrome Releases):

• CVE-2026-118306: memory corruption in FileSystem. The CVE record says a remote attacker could “potentially execute arbitrary code outside the sandbox” through a crafted HTML page, in Chrome before 156.0.8078.73 (CVE record).
• CVE-2026-118331: improper input validation in FileAPI.
• CVE-2026-118348: improper input validation in Skia.
• CVE-2026-118344: use-after-free in Layout.

29 October 2026: 156.0.8078.79/.80 for Windows and Mac, 156.0.8078.79 for Linux, on both Stable and Extended Stable. It has 21 more security fixes, including Critical CVE-2026-76024, memory corruption in MediaStream (Chrome Releases).

All five Critical bugs were reported by Xinyang Ge. Google credits two of them, CVE-2026-118306 and CVE-2026-118331, to “Xinyang Ge (Anthropic), assisted by Claude” (Chrome Releases). Many of the High-rated fixes also came from Xinyang Ge, Anthropic with Ada Logics, and OpenAI Codex Security.

On 27 October, Anthropic described a four-stage Chrome exploit chain that Claude built: two V8 bugs to take over the renderer, a CacheStorage race to read browser-process memory, and a use-after-free in FedCM to run code outside the sandbox. In the demo, a default Chrome on macOS opened Calculator seconds after loading a page. Anthropic says 62 CVEs from this work, all rated Critical or High, are patched as of Chrome 156 (Anthropic). The posts do not say which CVE numbers belong to that chain.

Neither release post says an exploit exists in the wild. CISA’s assessment on the CVE-2026-118306 record lists exploitation as “none” (CVE record). None of the five CVEs was in CISA’s KEV catalog as of its 30 October release (CISA KEV).

Am I affected?

Any Chrome desktop build older than 156.0.8078.79 misses at least CVE-2026-76024; builds before 156.0.8078.73 miss all five. Open chrome://version, or from a shell:

# Linux
google-chrome --version

# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version

# Windows
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

Chrome downloads updates in the background but applies them only on restart, so a long-running browser can show an old version.

Also check Chromium you do not see as “Chrome”: headless Chrome in scraping and PDF-rendering containers, browsers downloaded by Puppeteer or Playwright, and Electron or CEF apps. In an Electron app, process.versions.chrome gives the Chromium version it embeds. The Google posts cover only Chrome; other Chromium builds are fixed when their vendors pull in these patches.

What to do now

1. Update Chrome to 156.0.8078.79 or later and restart it. On managed fleets, check that the version reported by your management tool has moved, not just that the update was offered (Chrome Releases).
2. Extended Stable users: the 29 October build is the one to take. It was released on Extended Stable as well as Stable (Chrome Releases).
3. Rebuild containers that bundle Chrome or Chromium for automation, testing or rendering untrusted pages, and redeploy them. They load pages you do not control and stay on whatever Chromium the image was built with.
4. For Electron, CEF and other Chromium-based apps, watch for vendor releases that move to Chromium 156.0.8078.79 or later. Until then, do not use them to open untrusted web content.

Sources

• Chrome Releases: Stable Channel Update for Desktop (27 October 2026)
• Chrome Releases: Stable Channel Update for Desktop (29 October 2026)
• CVE record: CVE-2026-118306
• Anthropic: Discovering vulnerabilities with Claude
• CISA Known Exploited Vulnerabilities catalog