Google has issued a second large security patch for Chrome 156, fixing 52 flaws on desktop, including four rated Critical. If you use Chrome on Windows, Mac, or Linux, the move is simple: check your version and relaunch the browser. The update is rolling out over the coming days and weeks, so it may not reach every machine on the same day, but the patched build is the one to be on.
What the Chrome 156 update fixes
The 27 October 2026 Stable-channel update moves Windows and Mac to version 156.0.8078.73/.74 and Linux to 156.0.8078.73. It contains 52 security fixes: 4 Critical, 46 High, and 2 Medium. The High-severity fixes span V8, Turbolev, ANGLE, WebRTC, PDFium, WebAudio, Payments, and graphics and media components. Three named High-severity flaws are CVE-2026-118318, an improper access control issue in V8; CVE-2026-118333, a missing authorization issue in Video; and CVE-2026-118342, an out-of-bounds write in Editing.
TechReview’s own calculation from that split puts Critical flaws at 7.7% of the patch, High flaws at 88.5%, and Medium flaws at 3.8%. The shape of the patch matters: this is a high-severity bulk fix, not just a four-bug update with a few extras attached.
The four critical flaws
The first two Critical flaws were reported by Xinyang Ge of Anthropic, with Claude assistance. The other two were reported by Xinyang Ge on 17 October 2026. The list, with the component and flaw type for each:
- CVE-2026-118306: memory corruption in FileSystem, reported 7 October 2026 with Claude assistance.
- CVE-2026-118331: improper input validation in FileAPI, reported 11 October 2026 with Claude assistance.
- CVE-2026-118348: improper input validation in Skia, reported 17 October 2026.
- CVE-2026-118344: use after free in Layout, reported 17 October 2026.
Google is keeping bug details and links restricted until a majority of users have updated, and longer where a third-party library affects other projects. The notice does publish each flaw’s component and vulnerability type, but the detailed bug reports and links stay restricted, and it carries no exploit details.
How do I update Chrome to 156?
Open Chrome, go to Help, then About Google Chrome. Chrome checks for the update and installs it if one is available. Relaunch the browser to apply it. You want version 156.0.8078.73 or .74 on Windows and Mac, or 156.0.8078.73 on Linux. Linux users update through their package manager instead.
- Open Chrome, click the three-dot menu at the top right corner, and choose Help.
- Click About Google Chrome and wait for Chrome to check whether a newer version is available.
- Relaunch the Chrome browser after the update installs, since the patch applies only after a restart.
- Check the version shown on the About page to confirm it matches the patched build.
- Update through your package manager if you run Chrome on Linux, following the same version check.
If the About page shows no update yet, check again later. The rollout runs over days and weeks rather than landing everywhere at once, so a machine that shows no update today may show one tomorrow.
What is not confirmed
No exploitation is confirmed. Google’s public notice does not describe specific attack methods, confirm remote code execution, or state that attackers have exploited these vulnerabilities. SecurityOnline’s vulnerability roundup lists all four Critical CVEs as “Not exploited”. That is an absence of confirmed exploitation in the cited sources, not proof that no exploitation occurred. The patch is preventive: update because the flaws are rated Critical and High, not because an attack has been confirmed.
Two things this article does not claim. First, there is no affected-user or victim number for this patch in any verified source, so none appears here. Second, this article’s update steps cover the Windows, Mac, and Linux desktop release. Google also released Chrome 156 (156.0.8078.73) for Android, and Android releases contain the same security fixes as their corresponding desktop releases.
Why this patch is bigger than it looks
TechReview’s own calculation: this patch follows an earlier Chrome 156 update that fixed 353 security flaws. Added together, the Chrome 156 cycle has now seen 405 security fixes, with this follow-up patch adding about 15% on top of the initial batch (52 divided by 353 is 14.7%). The timeline behind the Critical four runs from the first report on 7 October, through a second on 11 October and the last two on 17 October, to the patch on 27 October. That is 10 days from the last Critical report to the patch, and 20 days from the first, with all four Critical reports tracing to one researcher.
One separate note from the same day: Mozilla also issued Firefox 159, fixing 167 vulnerabilities, according to Malwarebytes. That is a separate update and is not part of Chrome’s 52, but Firefox users should apply it the same way.
Sources
- CybersecurityNews, Google Fixes 52 Chrome Security Flaws, Including Four Critical Vulnerabilities, 28 October 2026.
- Malwarebytes, Chrome and Firefox updates fix serious security flaws. Install them now, October 2026.
- Chrome Releases notice as quoted by TechSpot, Google Chrome download page, accessed 28 October 2026.
- SecurityOnline, Chrome Security Update: 4 Critical Chrome Vulnerabilities, accessed 28 October 2026.
