Google Chrome update fixes 52 flaws, including four critical bugs

Google has released Chrome 156.0.8078.73/.74 for Windows and Mac, and 156.0.8078.73 for Linux, in a security update that fixes 52 vulnerabilities, including four rated as critical.

The most severe issue, CVE-2026-118306, is described as a memory corruption flaw in FileSystem that could let a remote attacker “potentially execute arbitrary code outside the sandbox via a crafted HTML page.” The other three critical flaws affect FileAPI (CVE-2026-118331), Skia (CVE-2026-118348), and Layout (CVE-2026-118344), each potentially allowing code execution inside the sandbox through a malicious web page. Google notes that no exploitation has been reported so far.

The update also covers 46 high-severity bugs across components such as V8, Turbop, ANGLE, Skia, and PDFium, with Google keeping many details private while the majority of users are updated. All Chrome versions prior to 156.0.8078.73 are affected on Windows, Mac and Linux. The Chrome release notes state that access to bug details and links may be restricted until a majority of users are updated with a fix.

Evidence of exploitation is not confirmed in CISA KEV, and Google describes the current status as not exploited for these flaws. The recommended action is to apply the latest Chrome security update promptly; users should open the Chrome menu, select Help and About Google Chrome, and relaunch once the update is installed, noting that rollout will continue over the coming days and weeks.