Google shipped Chrome 156.0.8078.73 for Windows and Linux, and 156.0.8078.74 for Mac, on 27 October with 52 security fixes. Four of them are rated Critical, and every one is reached by loading a page the attacker controls.
What happened
The most serious is CVE-2026-118306, a memory corruption bug in FileSystem that Google describes as potentially allowing arbitrary code execution outside the sandbox. Sandbox escape is what turns a browser crash into a compromised workstation.
CVE-2026-118348 is improper input validation in Skia, Chrome's graphics engine. CVE-2026-118344 is a use-after-free in Layout, and CVE-2026-118331 is improper input validation in FileAPI. Google rates both Skia and FileAPI as code execution inside the sandbox.
The credit list shows how much of this cycle came from AI-assisted research. Xinyang Ge of Anthropic, working with Claude, reported several of the Critical and High findings, and OpenAI's Codex Security team is credited on a further batch. The bugs themselves took weeks to surface, so the patch is the only defence that matters this week.
Who is affected
- Chrome on Windows and Mac below 156.0.8078.73 / 156.0.8078.74
- Chrome on Linux below 156.0.8078.73
- Other Chromium-based browsers and Electron apps that have not pulled the same engine fixes
CISA's advisory for this release, issued the same day, records no known exploitation of any of the 52 flaws. That is a statement about the past, not a guarantee about next week.
What to do now
Confirm the installed version on every managed endpoint, then force a restart, because the update only takes effect when the browser process is replaced.
- Open Help, then About Google Chrome, and read the version number rather than assuming the updater ran
- For fleets, set the update policy in the browser management console instead of relying on users to click restart
- Check Electron-based line-of-business apps separately, since they carry their own copy of the engine
- Do not treat this as an Edge problem solved by Windows Update alone; verify the Edge version independently
What this means for South African businesses
Browser flaws are the cheapest way into a small business, because they need one employee to open one page and no credentials, no VPN and no misconfiguration. A 30-person company with unmanaged laptops is 30 attempts at that single click, and most South African SMEs still let Chrome auto-update on its own schedule. My judgement is that the patched-population gap here is measured in weeks, not days, which is exactly the window a commodity attacker needs.
Source: Chrome Releases stable channel update, 27 October 2026.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.