Google’s Chrome update fixes 52 security issues, including four critical flaws

Google’s October 27, 2026 desktop Stable-channel update lists 52 security fixes for Chrome: four Critical, 46 High and two Medium. Google named builds 156.0.8078.73/.74 for Windows and Mac, and 156.0.8078.73 for Linux. It said rollout would take days or weeks.

What the 52 fixes cover

Google’s four Critical entries address memory corruption in FileSystem (CVE-2026-118306), improper input validation in FileAPI (CVE-2026-118331), improper input validation in Skia (CVE-2026-118348), and a use-after-free in Layout (CVE-2026-118344). A use-after-free occurs when software tries to use memory after it has been released.

Google credits Xinyang Ge with reporting all four. Its notice says Ge was assisted by Claude on CVE-2026-118306 and CVE-2026-118331; it does not list Claude’s assistance on the other two.

Chrome Stable builds for desktop

Google’s October 27 notice gives these Stable-channel builds and says rollout would take the coming days or weeks.

What a Critical rating means

Chromium’s severity guidance defines Critical as a flaw that could allow arbitrary code execution with the user’s privileges during normal browsing. Unusual or additional user interaction and other mitigating factors can lower a rating. The definition explains the severity category; it does not describe the conditions of every individual flaw. Chromium’s severity guidelines

Anthropic separately reported that an internal, unreleased research model produced a Chrome exploit chain on macOS. Anthropic said it ran code outside the browser sandbox on a default-configuration Chrome browser after a page loaded, without further user interaction. The reported chain involved V8, the V8 memory-region sandbox, CacheStorage and FedCM. This is Anthropic’s account of its research, separate from Google’s 52-fix update notice.

Check Chrome for the update

In Chrome, open the three-dot menu and choose Help > About Google Chrome. Chrome checks for an update on that page; restart the browser after an update installs. Google said the desktop rollout could take days or weeks, so the build may not appear on every computer at the same time.