Google is rolling out Chrome 156.0.8078.73 and .74 for desktop and Android to address 52 security vulnerabilities, including critical FileSystem and File API flaws that could enable remote code execution.
Google released an update for desktop and Android versions of Chrome on 27 October to fix 52 security vulnerabilities, including flaws rated severe. The company said the patches cover the browser’s Windows, macOS, Linux and Android builds, with the desktop release rolling out over the coming days and weeks and Android due to appear in Google Play within days.
Among the most serious issues identified by the Japanese technology site ASCII were critical weaknesses in Chrome’s FileSystem and File API components, including memory corruption and improper input validation. Security advisories published by vulnerability databases add detail to some of those bugs, saying a crafted HTML page could be used by a remote attacker to run code outside Chrome’s sandbox in the case of CVE-2026-118306. They also describe related flaws that could allow code execution inside the sandbox through similar attack vectors.
Other high-severity bugs listed in the update affect Chrome’s FileSystem and V8 engine, while medium-severity items include memory corruption in Paint and a use-after-free in Animation. Independent vulnerability tracking sites also flag separate Chrome defects in Compositing and WTF that were fixed in the same version line, underscoring the breadth of the security work in this release.
Users can install the update manually through Chrome’s settings rather than waiting for the automatic rollout. Security groups including HKCERT have echoed the need to move quickly to the fixed builds, which are version 156.0.8078.73 or .74 on desktop, and 156.0.8078.73 on Android.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
