Chrome update closes 29 vulnerabilities

Google released version 156.0.8078.73 for the Chrome browser. The 29 security vulnerabilities reflected in NVD records were fixed with this release. All of the vulnerabilities can be triggered through a crafted HTML page and can lead to code execution inside the browser’s sandbox.

Which components were affected

The fixed vulnerabilities are spread across Chrome’s core components. The list includes parts such as the V8 JavaScript engine, the Skia graphics library, WebAudio, WebRTC, PDFium, FileAPI, SVG, Layout, Compositing, Paint, and ReadingList. The vulnerability types fall into three categories: memory corruption, use-after-free, and missing input validation.

NVD assigns all of the vulnerabilities a CVSS score of 8.8. In Chromium’s own security assessment, three vulnerabilities are marked as critical: the input validation error in Skia (CVE-2026-118348), the use-after-free in the Layout component (CVE-2026-118344), and the input validation error in FileAPI (CVE-2026-118331). The other records are rated high.

What the risk means for users

For vulnerabilities like these, all an attacker needs is for the user to open a crafted page. When the page loads, a memory error is triggered and code can be executed within the browser process. On its own, this does not mean the entire computer is compromised; however, it can be used as the first link in an attack chain.

There is currently no sign that these vulnerabilities are being actively exploited. The records are not listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Still, because the browser is the desktop application that receives the most external data, there is no reason to delay the update.

How to update

Open Chrome and click the three dots in the upper right, then go to Help and select About Chrome. If the version does not show as 156.0.8078.73, the update will download immediately; after that, just press the Relaunch button. You can also reach the same screen by typing chrome://settings/help into the address bar.

If automatic updates are enabled, the file downloads in the background, but it does not take effect until the browser is completely closed and reopened. That is why users who keep tabs open for a long time may remain on the old version.

The fix covers the mobile side as well as the desktop versions. The vulnerability in the Android-specific UI component, CVE-2026-118314, and the ANGLE error on macOS, CVE-2026-118329, were closed in the same announcement. On Android, you need to check for the update through the Play Store. On Linux distributions, the update comes from the distribution’s package manager.

Browsers based on Chromium, such as Edge, Brave, Opera, and Vivaldi, usually bring the same fixes into their own releases within a few days. Users of these browsers only need to check their own version numbers. Google does not share details until most users have received the update; the release notes were published on the Chrome Releases blog.

Source: NVD