Google Fixes 52 Chrome Security Flaws, Including Four Critical Vulnerabilities

Google released a Chrome security update that fixes 52 vulnerabilities, including four critical flaws affecting FileSystem, FileAPI, Skia, and Layout.

According to the release notice, the Stable channel is moving to version 156.0.8078.73/.74 for Windows and Mac. At the same time, Linux users will receive version 156.0.8078.73.

The update will reach users over the coming days and weeks. The supplied security list includes four critical vulnerabilities, 46 high-severity issues, and two medium-severity bugs. The fixes cover browser functions ranging from file handling and page rendering to JavaScript, graphics, video, and audio processing.

CVE-2026-118306 is a memory corruption flaw in FileSystem, reported on October 7 by Xinyang Ge of Anthropic with assistance from Claude. The second critical issue, CVE-2026-118331, involves improper input validation in FileAPI. Ge reported that vulnerability on October 11, also with Claude’s assistance.

The remaining critical bugs are CVE-2026-118348, an improper input validation issue in Skia, and CVE-2026-118344, a use-after-free flaw in Layout. Ge reported both on October 17. These findings highlight file operations and page display features as key areas this release addresses.

A use-after-free bug occurs when software accesses memory after it has been released. Input validation flaws involve inadequate checks on incoming data.

However, the supplied notice does not describe specific attack methods, confirm remote code execution, or state that attackers have exploited these vulnerabilities.

Google Fixes 52 Chrome Security Flaws

Google’s high-severity fixes address memory corruption, use-after-free, input validation, access control, and authorization flaws across V8, Turbolev, ANGLE, WebRTC, PDFium, WebAudio, Payments, and graphics and media components.

Notable entries include CVE-2026-118318, an improper access control flaw in V8, and CVE-2026-118333, a missing authorization issue in Video. Google also fixed CVE-2026-118342, an out-of-bounds write in Editing. The notice provides no detailed exploit conditions for these issues.

This release follows the earlier Chrome 156 update fixing 353 security flaws and a separate Chrome update addressing 32 vulnerabilities.

These releases highlight the importance of checking the installed Chrome build rather than relying solely on the browser’s major version number.

The notice credits Google researchers, independent contributors, Mozilla, Anthropic, Ada Logics, and OpenAI Codex Security. Several reports explicitly name AI assistance, although the credits do not establish that those tools independently discovered or verified every issue.

Critical Vulnerabilities :

High-Severity Vulnerabilities :

Medium-Severity Vulnerabilities :

Google says some bug details will remain restricted until most users have installed the fixes. Restrictions may last longer where shared libraries affect other projects. The Chromium Security page explains its coordinated approach to vulnerability disclosure.

Users should open Chrome’s menu, select Help, then About Google Chrome, and relaunch after any available update installs. Linux users should update through their package manager. Google’s Chrome update guide provides platform instructions.

Administrators should keep automatic updates enabled across managed Windows devices to receive critical security fixes promptly.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Google Fixes 52 Chrome Security Flaws, Including Four Critical Vulnerabilities appeared first on Cyber Security News.