Google patches 52 Chrome flaws, four rated critical
Anthropic's Claude AI model helped find two of the critical bugs, which were reported to Google on October 7 and October 11.
Google has released an emergency security update for Chrome 156 that fixes 52 vulnerabilities, four of them rated critical, according to dailysecu.com. The four critical flaws are tracked as CVE-2026-118306, CVE-2026-118331, CVE-2026-118348 and CVE-2026-118344.
CVE-2026-118306 is a memory corruption flaw in Chrome's filesystem feature that could potentially allow arbitrary code execution outside the browser sandbox. CVE-2026-118331 is an input validation error in a file API, CVE-2026-118348 is an input validation error in the Skia graphics component, and CVE-2026-118344 is a use-after-free flaw in webpage rendering.
Two of the critical bugs were found by Anthropic security researcher Xinyang Ge with the assistance of the Claude AI model, and were reported to Google on October 7 and October 11. OpenAI's Codex Security separately reported CVE-2026-118350, a use-after-free flaw in the TurboLev JavaScript optimization component.
The remaining fixes cover 46 high-severity and 2 medium-severity vulnerabilities in components including the V8 JavaScript engine, the graphics engine, webpage editing and file handling.
The updated builds are 156.0.8078.73 or 156.0.8078.74 on Windows and Mac, and 156.0.8078.73 on Linux. Google is rolling out the update gradually and plans to limit disclosure of technical details for some vulnerabilities until patches are widely applied. The company's announcement does not confirm that any of the flaws have been exploited in real cyberattacks.
Quick answers
Which Chrome versions fix the 52 vulnerabilities?
The updated builds are 156.0.8078.73 or 156.0.8078.74 on Windows and Mac, and 156.0.8078.73 on Linux.
Were the Chrome vulnerabilities exploited in attacks?
Google's announcement does not confirm that any of the vulnerabilities have been exploited in real cyberattacks.
How were the two critical Chrome bugs found?
Anthropic researcher Xinyang Ge found CVE-2026-118306 and CVE-2026-118331 with the assistance of the Claude AI model.