Chrome: four critical fixes (Oct 27 update)

Chrome

Google's Oct 27 Stable update for desktop has 52 security fixes. Google rates four Critical: memory corruption in FileSystem (CVE-2026-118306), improper input validation in FileAPI (CVE-2026-118331) and Skia (CVE-2026-118348), and a use after free in Layout (CVE-2026-118344).

Do this now

Update Chrome to 156.0.8078.73 on Linux, or 156.0.8078.73 or 156.0.8078.74 on Windows and Mac, or later.

Fix it

Chrome

On 156.0.8078.73.xUpgrade to Chrome 156.0.8078.73
On 156.0.8078.74.xUpgrade to Chrome 156.0.8078.74

Playwright 1.64.1 bundles Chromium 156.0.8078.4, older than this fix. (source)
Playwright's chromiumSandbox option defaults to false. (source)
[N/A][571156746] Critical CVE-2026-118306: Memory corruption in FileSystem. / [TBD][572193211] Critical CVE-2026-118331: Improper input validation in FileAPI. / [N/A][574776938] Critical CVE-2026-118348: Improper input validation in Skia. / [N/A][574852698] Critical CVE-2026-118344: Use after free in Layout. (vendor advisory)

First seen: 27 Oct 2026
Last update: 3 Nov 2026, 08:56 UTC
Fixed in: 156.0.8078.73
156.0.8078.74
Identifiers: CVE-2026-118306
CVE-2026-118344
CVE-2026-118348
Source: manual
On the menu as: Chrome

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Chrome: four critical fixes (Oct 27 update)
Severity: critical. Patch status: patched.
Affected: Chrome
Fixed in: 156.0.8078.73, 156.0.8078.74
Ids: CVE-2026-118306, CVE-2026-118344, CVE-2026-118348

Google's Oct 27 Stable update for desktop has 52 security fixes. Google rates four Critical: memory corruption in FileSystem (CVE-2026-118306), improper input validation in FileAPI (CVE-2026-118331) and Skia (CVE-2026-118348), and a use after free in Layout (CVE-2026-118344).

## Steps
1. Search the repo, its CI and infra config for Chrome. If present, report the version in use and whether it's affected.
2. Fix by release line: Chrome: 156.0.8078.73; 156.0.8078.74.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Chrome | fixed | 156.0.8078.73 | — |
| Chrome | fixed | 156.0.8078.74 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-118306") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html
https://pwned.coffee/i/chrome-stable-2026-10-27

Receipt

Exploitation: No known exploitation
Checked by hand “Google Chrome Releases, 27 Oct 2026 (read 3 Nov 2026), rates CVE-2026-118306, CVE-2026-118331, CVE-2026-118348 and CVE-2026-118344 Critical: "The Stable channel has been updated to 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 to Linux which will roll out over the coming days/weeks."” source
Fix by release line: Product Affected Fixed in Source
Chrome before 156.0.8078.73 156.0.8078.73 Checked by hand checked 3 Nov
Chrome before 156.0.8078.74 156.0.8078.74 Checked by hand checked 3 Nov
Score: Severity critical, checked by hand: Google Chrome Releases, 27 Oct 2026 (read 3 Nov 2026), rates CVE-2026-118306, CVE-2026-118331, CVE-2026-118348 and CVE-2026-118344 Critical: "The Stable channel has been updated to 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 to Linux which will roll out over the coming days/weeks."
Last checked: 4 Nov 2026, 08:18 UTC

Product	Affected	Fixed in	Source
Chrome	before 156.0.8078.73	156.0.8078.73	Checked by hand checked 3 Nov
Chrome	before 156.0.8078.74	156.0.8078.74	Checked by hand checked 3 Nov

Sources: KEV – CVE record – Vendor ✓

Sources

Chrome Releases: Stable Channel Update for Desktop (Oct 27)

Totalone very hot coffee