Chrome fixes four critical flaws, including CVE-2026-118306 sandbox escape
Four critical Chrome flaws could let malicious web pages run code, including outside Chrome's protective sandbox. Fixes are available for desktop and Android. Update Chrome and relaunch it; Chromebook users should install the latest ChromeOS update.
On a computer, open Chrome's menu → Help → About Google Chrome, install the latest update and relaunch; the first fixed desktop builds are 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux. Update Chrome on Android through Google Play to 156.0.8078.73 or later. On a Chromebook, install ChromeOS 16836.30.0 or later; ask IT to update managed devices.
- Google Chromefixed in 156.0.8078.73 and later
- Google Chromefixed in 156.0.8078.73 and later
- Google Chromefixed in 156.0.8078.73 and later
- Google Chromefixed in 156.0.8078.73 and later
- ChromeOSfixed in 16836.30.0 and later
- ChromeOS Flexfixed in 16836.30.0 and later
What’s happening
Google fixed four critical flaws in Chrome's file handling, graphics and page layout components on 27 October. Google's CVE descriptions say malicious web pages could use CVE-2026-118306 to run code outside the browser's protective sandbox; the other three allow code execution inside it. Chrome versions before 156.0.8078.73 are affected. Desktop fixes arrived in 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux, with Android fixes in 156.0.8078.73. Newer desktop builds followed on 29 October. ChromeOS and ChromeOS Flex 16836.30.0 explicitly fix CVE-2026-118331; their notice does not establish whether the other three affect ChromeOS. These are released fixes, although Google announced staged rollouts. Attack use is not confirmed: CIS reported no known exploitation on 27 October, and Avertium's 2 November report also said exploitation was unconfirmed.
- What
- Flaw
- Affects
- Google Chrome on Windows, Mac, Linux and Android; ChromeOS and ChromeOS Flex for CVE-2026-118331
- Affected
- Google Chrome prior to 156.0.8078.73
ChromeOS and ChromeOS Flex: CVE-2026-118331; Google does not specify the affected version range - Fixed in
- Google Chrome 156.0.8078.73/.74 for Windows and Mac
Google Chrome 156.0.8078.73 for Linux
Google Chrome 156.0.8078.73 for Android
ChromeOS and ChromeOS Flex 16836.30.0, browser 156.0.8078.77: explicitly fixes CVE-2026-118331 - Since
- 27 Oct 2026
Timeline
- Update
Avertium reported that active exploitation was not confirmed. It dated the initial desktop release 28 October, while Google's own advisory is dated 27 October.
- Update
Google announced newer Stable and Extended Stable desktop builds: 156.0.8078.79/.80 for Windows and Mac and 156.0.8078.79 for Linux.
- New fix
Google announced ChromeOS and ChromeOS Flex 16836.30.0, with browser version 156.0.8078.77. The notice explicitly lists CVE-2026-118331 as fixed; it does not name the other three flaws.
- New fix
Google released Chrome 156.0.8078.73 for Android. Its notice says Android includes the corresponding desktop security fixes unless otherwise stated.
- Made publicFixed
Google released Chrome 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux, fixing all four critical flaws among 52 security fixes.
Sources
- Stable Channel Update for DesktopGoogle · 27 Oct 2026
- Chrome for Android UpdateGoogle · 27 Oct 2026
- Stable Channel Update for ChromeOS / ChromeOS FlexGoogle · 28 Oct 2026
- Chrome Releases: 29 October desktop updateGoogle · 29 Oct 2026
- CVE-2026-118306: Chrome CNA recordGoogle Chrome via CVE.org · 27 Oct 2026
- CVE-2026-118331: Chrome CNA recordGoogle Chrome via CVE.org · 27 Oct 2026
- CVE-2026-118348: Chrome CNA recordGoogle Chrome via CVE.org · 27 Oct 2026
- CVE-2026-118344: Chrome CNA recordGoogle Chrome via CVE.org · 27 Oct 2026
- Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code ExecutionCenter for Internet Security · 27 Oct 2026
- Google Fixes 52 Chrome Security Flaws, Including 4 Critical Memory-Corruption BugsAvertium · 2 Nov 2026