[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

official (Google Chrome Releases, Oct 27; rolling out over days/weeks); no exploitation noted

Chrome 156.0.8078.73 fixes 52 security bugs, four of them critical (FileSystem, FileAPI, Skia, Layout), with most of the criticals credited to Anthropic's Claude-assisted research

Google's Oct 27 stable update brings Chrome to 156.0.8078.73/.74 on Windows and Mac and 156.0.8078.73 on Linux. It contains 52 security fixes: 4 critical, 46 high and 2 medium. Google does not say any are exploited.

  • Critical: CVE-2026-118306 (memory corruption in FileSystem), CVE-2026-118331 (improper input validation in FileAPI), CVE-2026-118348 (improper input validation in Skia) and CVE-2026-118344 (use after free in Layout), all reported by Xinyang Ge of Anthropic, two of them marked "assisted by Claude."
  • Who found the rest: many highs come from Google's own work, several from Anthropic, and four from "OpenAI Codex Security," including use-after-free bugs in Turbolev, ImageCapture, Video and PDFium.

What to do: make sure managed Chrome is on 156.0.8078.73 or later and has been relaunched; the update rolls out gradually, so force it through policy rather than waiting. Chromium-based browsers (Edge, Brave, Opera, Vivaldi) will need their own builds with these fixes.

Sources: Chrome Releases: Stable Channel Update for Desktop, 156.0.8078.73/.74 (Oct 27)