Threat reportVulnerabilityTL-2026-4646
Google Chrome 156 Security Update Fixes 52 Flaws Including Four Critical (CVE-2026-118306, CVE-2026-118331, CVE-2026-118348, CVE-2026-118344)
Google Chrome 156 Security Update Fixes 52 Flaws Including (TL-2026-4646) is a critical-severity software vulnerability, first published 2026-10-28. It has no confirmed attribution, affects Google Chrome (desktop: Windows, macOS, Linux), references 4 CVEs (CVE-2026-118306, CVE-2026-118331, CVE-2026-118348), maps to 3 MITRE ATT&CK techniques (T1059.007, T1203, T1204.001), and is covered by 9 detection rules and 13 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-4646
- Threat ID
- TL-2026-4646
- Severity
- CRITICAL
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, health, education
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 13
How Google Chrome 156 Security Update Fixes 52 Flaws Including works
Google fixed 52 Chrome security vulnerabilities (4 critical, 46 high, 2 medium) in Chrome 156.0.8078.73/.74 for Windows/Mac and 156.0.8078.73 for Linux. The critical flaws are memory corruption in FileSystem, improper input validation in FileAPI and Skia, and use-after-free in Layout. No source states these are exploited in the wild.
On 2026-10-27 Google published a Chrome Stable channel update for desktop (156.0.8078.73/.74 for Windows and Mac, 156.0.8078.73 for Linux) that addresses 52 security vulnerabilities: 4 Critical, 46 High and 2 Medium. Affected components include FileSystem, FileAPI, Skia, Layout, V8, Turbolev, ANGLE, WebRTC, PDFium, Media, Video, SVG, Paint, Compositing, Animation, WebAudio and others. Rollout takes place over the coming days and weeks.
The four Critical issues, per NVD descriptions, all require a remote attacker to deliver a crafted HTML page. CVE-2026-118306 (FileSystem, memory corruption, CWE-119) could allow potential arbitrary code execution OUTSIDE the sandbox, which makes it the most severe of the four because it does not require a separate sandbox escape. CVE-2026-118331 (FileAPI, improper input validation, CWE-20), CVE-2026-118348 (Skia, improper input validation, CWE-20) and CVE-2026-118344 (Layout, use-after-free, CWE-416) allow arbitrary code execution inside the renderer sandbox. The report credits Xinyang Ge of Anthropic (with assistance from Claude on the first two) for all four critical findings, reported on 2026-10-07, 2026-10-11 and 2026-10-17 (two). The advisory also credits Google researchers, independent contributors, Mozilla, Ada Logics and OpenAI Codex Security for other fixes.
The 46 High-severity flaws are mostly use-after-free, memory corruption and improper input validation bugs, with a smaller number of improper access control, missing authorization and out-of-bounds write issues (e.g. CVE-2026-118342 Editing). The 2 Medium flaws are CVE-2026-118312 (Paint, memory corruption) and CVE-2026-118338 (Animation, use-after-free). Bug details are restricted until most users have updated, with longer restrictions where third-party libraries are involved.
The source material does not describe attack methods, does not confirm an in-the-wild exploit or public proof-of-concept, and gives no CVSS scores. The four critical CVEs were not found in the portion of the CISA KEV catalog that could be read (first 100,000 characters of the feed; the remainder was not examined). This should be handled as a patch-priority item, not an active campaign. No network IOCs are associated with the threat, so BeaconBeagle correlation was not applicable.
MITRE ATT&CK techniques used in TL-2026-4646
Execution
T1059.007 Command and Scripting Interpreter: JavaScript; T1203 Exploitation for Client Execution; T1204.001 User Execution: Malicious Link
Affected products and versions in Google Chrome 156 Security Update Fixes 52 Flaws Including
- Google — Chrome (desktop: Windows, macOS, Linux)
Vulnerable versions: < 156.0.8078.73
Fixed in: 156.0.8078.73/.74 (Windows, Mac); 156.0.8078.73 (Linux)
Remediation for Google Chrome 156 Security Update Fixes 52 Flaws Including
Patches
- Google Chrome 156.0.8078.73/.74 for Windows and Mac
- Google Chrome 156.0.8078.73 for Linux (update through the distribution package manager)
Immediate actions
- Update Google Chrome to 156.0.8078.73/.74 (Windows/Mac) or 156.0.8078.73 (Linux) via Menu > Help > About Google Chrome and relaunch the browser
- Prioritize patching of internet-facing user workstations and VDI images running Chrome below 156.0.8078.73
Workarounds
- No workaround is documented in the sources; limit browsing to trusted sites until the update is applied
Longer-term hardening
- Enforce browser auto-update and maximum-age policies through enterprise management
- Inventory Chromium-based browsers and embedded Chromium runtimes and track vendor uptake of the fixes
- Keep site isolation and the renderer sandbox enabled
CVEs associated with Google Chrome 156 Security Update Fixes 52 Flaws Including
CVE-2026-118306, CVE-2026-118331, CVE-2026-118348, CVE-2026-118344
Weaknesses (CWE) in Google Chrome 156 Security Update Fixes 52 Flaws Including
Timeline of Google Chrome 156 Security Update Fixes 52 Flaws Including
- Xinyang Ge of Anthropic (with assistance from Claude) reports the FileSystem memory corruption flaw later assigned CVE-2026-118306.
- Xinyang Ge of Anthropic (with assistance from Claude) reports the FileAPI improper input validation flaw later assigned CVE-2026-118331.
- Xinyang Ge reports the Skia input validation flaw (CVE-2026-118348) and the Layout use-after-free (CVE-2026-118344).
- Staged rollout of the fixed build starts to desktop users over the coming days and weeks; bug details stay restricted until most users have updated.
- NVD publishes the CVE records, e.g. CVE-2026-118306 (CWE-119): FileSystem memory corruption allowing potential code execution outside the sandbox via a crafted HTML page; no CVSS data supplied.
- Google publishes the Chrome Stable channel update 156.0.8078.73/.74 (Windows/Mac) and 156.0.8078.73 (Linux) fixing 52 flaws (4 Critical, 46 High, 2 Medium).
- Cyber Security News reports the update (dating the release 2026-10-28): 4 Critical, 46 High, 2 Medium; the notice states no attack methods, RCE confirmation or in-the-wild exploitation.
Sources cited for Google Chrome 156 Security Update Fixes 52 Flaws Including
- Google Fixes 52 Chrome Security Flaws, Including Four Critical Vulnerabilities
- Chrome Releases: Stable Channel Update for Desktop
- NVD: CVE-2026-118306 (FileSystem memory corruption)
- NVD: CVE-2026-118331 (FileAPI improper input validation)
- NVD: CVE-2026-118348 (Skia improper input validation)
- NVD: CVE-2026-118344 (Layout use-after-free)
- Chromium issue 571156746 (CVE-2026-118306)
- Chromium issue 572193211 (CVE-2026-118331)
- Chromium issue 574776938 (CVE-2026-118348)
- Chromium issue 574852698 (CVE-2026-118344)
Detection coverage for TL-2026-4646
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4646 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.