---
title: Chrome 156.0.8078.73 fixes 52 security bugs, four of them critical (FileSystem, FileAPI, Skia, Layout), with most of the criticals credited to Anthropic's Claude-assisted research | ctxsec
url: https://ctxsec.com/items/chrome-156-0-8078-73-52-security-fixes-4-critical
description: ""
status: "official (Google Chrome Releases, Oct 27; rolling out over days/weeks); no exploitation noted"
published: 2026-10-29
---

> 

[← Cybersecurity News](/news) · [markdown](/items/chrome-156-0-8078-73-52-security-fixes-4-critical.md)

official (Google Chrome Releases, Oct 27; rolling out over days/weeks); no exploitation noted

2026-10-29

### Chrome 156.0.8078.73 fixes 52 security bugs, four of them critical (FileSystem, FileAPI, Skia, Layout), with most of the criticals credited to Anthropic's Claude-assisted research

Google's Oct 27 stable update brings Chrome to **156.0.8078.73/.74** on Windows and Mac and **156.0.8078.73** on Linux. It contains 52 security fixes: 4 critical, 46 high and 2 medium. Google does not say any are exploited.

- **Critical:** CVE-2026-118306 (memory corruption in FileSystem), CVE-2026-118331 (improper input validation in FileAPI), CVE-2026-118348 (improper input validation in Skia) and CVE-2026-118344 (use after free in Layout), all reported by Xinyang Ge of Anthropic, two of them marked "assisted by Claude."
- **Who found the rest:** many highs come from Google's own work, several from Anthropic, and four from "OpenAI Codex Security," including use-after-free bugs in Turbolev, ImageCapture, Video and PDFium.

**What to do:** make sure managed Chrome is on 156.0.8078.73 or later and has been relaunched; the update rolls out gradually, so force it through policy rather than waiting. Chromium-based browsers (Edge, Brave, Opera, Vivaldi) will need their own builds with these fixes.

Sources: [Chrome Releases: Stable Channel Update for Desktop, 156.0.8078.73/.74 (Oct 27)](https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html)