Chrome 156 patches 52 flaws, one a sandbox escape
The 27 October stable update fixes four critical bugs, including a FileSystem flaw that can let an attacker break out of the browser sandbox.
Google pushed Chrome 156 to the stable channel on 27 October: version 156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux, with the same fixes landing on Android. The release patches 52 security issues.
Four are rated critical, and all four are memory-safety bugs: memory corruption in FileSystem (CVE-2026-118306), improper input validation in FileAPI (CVE-2026-118331) and in Skia (CVE-2026-118348), and a use-after-free in Layout (CVE-2026-118344). The FileSystem bug is the one to note: Chrome’s advisory describes it as letting an attacker run code outside the sandbox via a crafted HTML page, the most serious class of browser vulnerability there is. The advisory doesn’t list any of the 52 as exploited in the wild, and none appear on CISA’s Known Exploited Vulnerabilities catalog.
Why it matters: this lands on every Chromium-based browser, not just Chrome, so Edge, Brave and Opera inherit the same fixes once they rebase. A sandbox-escape bug, even one with no known exploitation yet, is worth updating for rather than waiting on auto-update’s own schedule.
The caveat: the desktop rollout is staged over the coming days and weeks, and the write-up gives detail only on the four critical bugs. The other 48, across high, medium and low severity, are listed by component without individual descriptions.