{"id":"chrome-four-critical-flaws-oct-2026","category":"patch","status":"live","title":"Chrome fixes four critical flaws, including CVE-2026-118306 sandbox escape","tldr":"Four critical Chrome flaws could let malicious web pages run code, including outside Chrome's protective sandbox. Fixes are available for desktop and Android. Update Chrome and relaunch it; Chromebook users should install the latest ChromeOS update.","summary":"Google fixed four critical flaws in Chrome's file handling, graphics and page layout components on 27 October. Google's CVE descriptions say malicious web pages could use CVE-2026-118306 to run code outside the browser's protective sandbox; the other three allow code execution inside it. Chrome versions before 156.0.8078.73 are affected. Desktop fixes arrived in 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux, with Android fixes in 156.0.8078.73. Newer desktop builds followed on 29 October. ChromeOS and ChromeOS Flex 16836.30.0 explicitly fix CVE-2026-118331; their notice does not establish whether the other three affect ChromeOS. These are released fixes, although Google announced staged rollouts. Attack use is not confirmed: CIS reported no known exploitation on 27 October, and Avertium's 2 November report also said exploitation was unconfirmed.","action":"On a computer, open Chrome's menu → Help → About Google Chrome, install the latest update and relaunch; the first fixed desktop builds are 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux. Update Chrome on Android through Google Play to 156.0.8078.73 or later. On a Chromebook, install ChromeOS 16836.30.0 or later; ask IT to update managed devices.","product":"Google Chrome on Windows, Mac, Linux and Android; ChromeOS and ChromeOS Flex for CVE-2026-118331","audience":"both","severity":"high","patch":"patched","exploited":false,"cves":["CVE-2026-118306","CVE-2026-118331","CVE-2026-118348","CVE-2026-118344"],"tags":["google","chrome","android","chromeos","browser","code-execution"],"affected":["Google Chrome prior to 156.0.8078.73","ChromeOS and ChromeOS Flex: CVE-2026-118331; Google does not specify the affected version range"],"fixed":["Google Chrome 156.0.8078.73/.74 for Windows and Mac","Google Chrome 156.0.8078.73 for Linux","Google Chrome 156.0.8078.73 for Android","ChromeOS and ChromeOS Flex 16836.30.0, browser 156.0.8078.77: explicitly fixes CVE-2026-118331"],"matches":[{"platform":"macos","app":"Google Chrome","bundle":"com.google.Chrome","fixed":"156.0.8078.73"},{"platform":"windows","app":"Google Chrome","bundle":"","fixed":"156.0.8078.73"},{"platform":"linux","app":"Google Chrome","bundle":"","fixed":"156.0.8078.73"},{"platform":"android","app":"Google Chrome","bundle":"com.android.chrome","fixed":"156.0.8078.73"},{"platform":"other","app":"ChromeOS","bundle":"","fixed":"16836.30.0"},{"platform":"other","app":"ChromeOS Flex","bundle":"","fixed":"16836.30.0"}],"sources":[{"kind":"advisory","title":"Stable Channel Update for Desktop","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","by":"Google","date":"2026-10-27"},{"kind":"advisory","title":"Chrome for Android Update","url":"https://chromereleases.googleblog.com/2026/10/chrome-for-android-update_0160078013.html","by":"Google","date":"2026-10-27"},{"kind":"advisory","title":"Stable Channel Update for ChromeOS / ChromeOS Flex","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01748991111.html","by":"Google","date":"2026-10-28"},{"kind":"advisory","title":"Chrome Releases: 29 October desktop update","url":"https://chromereleases.googleblog.com/","by":"Google","date":"2026-10-29"},{"kind":"advisory","title":"CVE-2026-118306: Chrome CNA record","url":"https://www.cve.org/CVERecord?id=CVE-2026-118306","by":"Google Chrome via CVE.org","date":"2026-10-27"},{"kind":"advisory","title":"CVE-2026-118331: Chrome CNA record","url":"https://www.cve.org/CVERecord?id=CVE-2026-118331","by":"Google Chrome via CVE.org","date":"2026-10-27"},{"kind":"advisory","title":"CVE-2026-118348: Chrome CNA record","url":"https://www.cve.org/CVERecord?id=CVE-2026-118348","by":"Google Chrome via CVE.org","date":"2026-10-27"},{"kind":"advisory","title":"CVE-2026-118344: Chrome CNA record","url":"https://www.cve.org/CVERecord?id=CVE-2026-118344","by":"Google Chrome via CVE.org","date":"2026-10-27"},{"kind":"advisory","title":"Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution","url":"https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-122","by":"Center for Internet Security","date":"2026-10-27"},{"kind":"news","title":"Google Fixes 52 Chrome Security Flaws, Including 4 Critical Memory-Corruption Bugs","url":"https://www.avertium.com/flash-notices/google-fixes-52-chrome-security-flaws-including-4-critical-memory-corruption-bugs","by":"Avertium","date":"2026-11-02"}],"started":"2026-10-27","closed":null,"created":"2026-11-03T12:31:33.433Z","updated":"2026-11-03T12:31:33.433Z","cve_notes":[{"cve":"CVE-2026-118306","name":"Memory corruption in Chrome's FileSystem","what":"A memory-handling flaw in Chrome's FileSystem component could let a malicious web page run attacker-controlled code outside the browser's protective sandbox.","severity":"critical","cvss":0},{"cve":"CVE-2026-118331","name":"Input validation flaw in Chrome's FileAPI","what":"Inadequate input checks in Chrome's FileAPI component could let a malicious web page run attacker-controlled code inside the browser's sandbox.","severity":"critical","cvss":0},{"cve":"CVE-2026-118348","name":"Input validation flaw in Chrome's Skia graphics","what":"Inadequate input checks in Chrome's Skia graphics component could let a malicious web page run attacker-controlled code inside the browser's sandbox.","severity":"critical","cvss":0},{"cve":"CVE-2026-118344","name":"Use-after-free in Chrome's Layout component","what":"Chrome's Layout component can reuse memory after releasing it, allowing a malicious web page to run attacker-controlled code inside the browser's sandbox.","severity":"critical","cvss":0}],"timeline":[{"at":"2026-11-02","added":"2026-11-03T12:28:04.995Z","kind":"other","text":"Avertium reported that active exploitation was not confirmed. It dated the initial desktop release 28 October, while Google's own advisory is dated 27 October.","url":"https://www.avertium.com/flash-notices/google-fixes-52-chrome-security-flaws-including-4-critical-memory-corruption-bugs","by":"Avertium","patch":null},{"at":"2026-10-29","added":"2026-11-03T12:28:04.995Z","kind":"other","text":"Google announced newer Stable and Extended Stable desktop builds: 156.0.8078.79/.80 for Windows and Mac and 156.0.8078.79 for Linux.","url":"https://chromereleases.googleblog.com/","by":"Google","patch":null},{"at":"2026-10-28","added":"2026-11-03T12:28:04.995Z","kind":"new-fix","text":"Google announced ChromeOS and ChromeOS Flex 16836.30.0, with browser version 156.0.8078.77. The notice explicitly lists CVE-2026-118331 as fixed; it does not name the other three flaws.","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01748991111.html","by":"Google","patch":null},{"at":"2026-10-27","added":"2026-11-03T12:28:04.995Z","kind":"new-fix","text":"Google released Chrome 156.0.8078.73 for Android. Its notice says Android includes the corresponding desktop security fixes unless otherwise stated.","url":"https://chromereleases.googleblog.com/2026/10/chrome-for-android-update_0160078013.html","by":"Google","patch":null},{"at":"2026-10-27","added":"2026-11-03T12:28:04.995Z","kind":"disclosed","text":"Google released Chrome 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux, fixing all four critical flaws among 52 security fixes.","url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","by":"Google","patch":"patched"}],"url":"https://hard.fyi/live/chrome-four-critical-flaws-oct-2026/","json":"https://hard.fyi/api/live?id=chrome-four-critical-flaws-oct-2026"}