# Google Chrome 156 Security Update Fixes 52 Flaws Including Four Critical (CVE-2026-118306, CVE-2026-118331, CVE-2026-118348, CVE-2026-118344)

> Google fixed 52 Chrome security vulnerabilities (4 critical, 46 high, 2 medium) in Chrome 156.0.8078.73/.74 for Windows/Mac and 156.0.8078.73 for Linux. The critical flaws are memory corruption in FileSystem, improper input validation in FileAPI and Skia, and use-after-free in Layout. No source states these are exploited in the wild.

- **Published:** 2026-10-28T14:07:36Z
- **Last reviewed:** 2026-10-28T14:07:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4646
- **ID:** TL-2026-4646
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-118306, CVE-2026-118331, CVE-2026-118348, CVE-2026-118344

## Description

On 2026-10-27 Google published a Chrome Stable channel update for desktop (156.0.8078.73/.74 for Windows and Mac, 156.0.8078.73 for Linux) that addresses 52 security vulnerabilities: 4 Critical, 46 High and 2 Medium. Affected components include FileSystem, FileAPI, Skia, Layout, V8, Turbolev, ANGLE, WebRTC, PDFium, Media, Video, SVG, Paint, Compositing, Animation, WebAudio and others. Rollout takes place over the coming days and weeks.

The four Critical issues, per NVD descriptions, all require a remote attacker to deliver a crafted HTML page. CVE-2026-118306 (FileSystem, memory corruption, CWE-119) could allow potential arbitrary code execution OUTSIDE the sandbox, which makes it the most severe of the four because it does not require a separate sandbox escape. CVE-2026-118331 (FileAPI, improper input validation, CWE-20), CVE-2026-118348 (Skia, improper input validation, CWE-20) and CVE-2026-118344 (Layout, use-after-free, CWE-416) allow arbitrary code execution inside the renderer sandbox. The report credits Xinyang Ge of Anthropic (with assistance from Claude on the first two) for all four critical findings, reported on 2026-10-07, 2026-10-11 and 2026-10-17 (two). The advisory also credits Google researchers, independent contributors, Mozilla, Ada Logics and OpenAI Codex Security for other fixes.

The 46 High-severity flaws are mostly use-after-free, memory corruption and improper input validation bugs, with a smaller number of improper access control, missing authorization and out-of-bounds write issues (e.g. CVE-2026-118342 Editing). The 2 Medium flaws are CVE-2026-118312 (Paint, memory corruption) and CVE-2026-118338 (Animation, use-after-free). Bug details are restricted until most users have updated, with longer restrictions where third-party libraries are involved.

The source material does not describe attack methods, does not confirm an in-the-wild exploit or public proof-of-concept, and gives no CVSS scores. The four critical CVEs were not found in the portion of the CISA KEV catalog that could be read (first 100,000 characters of the feed; the remainder was not examined). This should be handled as a patch-priority item, not an active campaign. No network IOCs are associated with the threat, so BeaconBeagle correlation was not applicable.

## MITRE ATT&CK

- T1203 Exploitation for Client Execution
- T1204.001 User Execution: Malicious Link
- T1059.007 Command and Scripting Interpreter: JavaScript

## Sources

- [Google Fixes 52 Chrome Security Flaws, Including Four Critical Vulnerabilities](https://cybersecuritynews.com/google-fixes-52-chrome-security-flaws/)
- [Chrome Releases: Stable Channel Update for Desktop](https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html)
- [NVD: CVE-2026-118306 (FileSystem memory corruption)](https://nvd.nist.gov/vuln/detail/CVE-2026-118306)
- [NVD: CVE-2026-118331 (FileAPI improper input validation)](https://nvd.nist.gov/vuln/detail/CVE-2026-118331)
- [NVD: CVE-2026-118348 (Skia improper input validation)](https://nvd.nist.gov/vuln/detail/CVE-2026-118348)
- [NVD: CVE-2026-118344 (Layout use-after-free)](https://nvd.nist.gov/vuln/detail/CVE-2026-118344)
- [Chromium issue 571156746 (CVE-2026-118306)](https://issues.chromium.org/issues/571156746)
- [Chromium issue 572193211 (CVE-2026-118331)](https://issues.chromium.org/issues/572193211)
- [Chromium issue 574776938 (CVE-2026-118348)](https://issues.chromium.org/issues/574776938)
- [Chromium issue 574852698 (CVE-2026-118344)](https://issues.chromium.org/issues/574852698)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4646