Guide · Security

Chrome 156: 52 security fixes that only work once you restart

Google shipped one of its larger Chrome security releases on 27 October. There is no sign anyone is attacking these bugs yet, which makes this the easy kind of update: no emergency, just a browser restart on every computer in the business. The catch is that Chrome will not do that part for you.

By Elliot · Published 28 October 2026 · 6 min read

In short

Chrome 156.0.8078.73 fixes 52 security flaws, four of them rated critical.
Google has not said any of them is being exploited.
The fix downloads by itself but only applies when Chrome is restarted.
Check About Google Chrome on every machine, and update Edge when Microsoft releases its fix.

What happened

A routine release with an unusually long list

Chrome gets a security update roughly every week, and most carry a handful of fixes. The 27 October release carried 52. Nearly all are the classic browser bug: a mistake in how Chrome manages memory, which a carefully built web page might use to make the browser run code it should not. Visiting the wrong page is the whole attack; there is no file to open and nothing to click past.

Two layers make that harder than it sounds. Chrome runs each site in a sandbox, a walled-off process with few rights on your computer, so an attacker usually needs a second, separate flaw to break out. And none of these bugs is public in detail yet: Google keeps the technical reports locked until most people have updated. That is the window this release closes.

The 27 October Chrome release, as of 28 October 2026
Released	Tuesday 27 October 2026, rolling out to everyone over the following days and weeks
Fixed version	156.0.8078.73 or .74 on Windows and Mac, 156.0.8078.73 on Linux
Security fixes	52 in total: 4 rated Critical, 46 High and 2 Medium by Chromium's own scale
Worst kind of bug	Memory corruption, where a booby-trapped web page could make Chrome run an attacker's code
Exploited?	Google's post does not say any of the 52 is being used in attacks, and none was on CISA's exploited list when we checked
Edge, Brave and others	Built on the same engine but released separately. Microsoft said on 27 October that an Edge fix was in progress

The fixes

Four critical, and one that made the headlines

Severity is Chromium's own rating, taken from Google's release post.

security fixes in one desktop release

Source: Chrome Releases

rated Critical, the top of Chromium's scale

Source: Chrome Releases

flagged by Google as exploited in the wild

Source: Chrome Releases, CISA

The V8 bug below, CVE-2026-118320, is the one doing the rounds on social media, mostly because automated CVE feeds post every high-scoring record. It is one of 46 High-rated fixes in the same release, not a special case. The four Critical ones sit in parts of Chrome that handle files and draw pages, which is why they rank higher.

The four Critical fixes, plus the widely shared V8 bug
CVE	Part of Chrome	In plain English
CVE-2026-118306	FileSystem	Memory corruption in the code that handles files a website is allowed to read or save
CVE-2026-118331	FileAPI	Input not properly checked when a page works with files you pick or drop into it
CVE-2026-118348	Skia	Input not properly checked in the graphics library that draws every page, image and font
CVE-2026-118344	Layout	Use after free in the code that decides where everything on a page sits
CVE-2026-118320	V8 (High)	Memory corruption in Chrome's JavaScript engine. The record says a crafted page could run code inside Chrome's sandbox

Which machines

Where the old version tends to linger

Everyone on desktop Chrome needs this. These are the places it gets missed.

Every desktop running Chrome

Windows, Mac and Linux machines are all covered by the 27 October release. If a laptop shows a version below 156.0.8078.73, it is missing all 52 fixes, not just one.

Laptops that are never shut down

Chrome fetches the update quietly but only switches to it when the browser restarts. A machine that sleeps rather than shuts down, with forty tabs kept open for weeks, can sit on the old version long after the download.

Staff who ignore the coloured button

When an update is waiting, Chrome shows an Update button in the top right corner, turning from green to amber to red as days pass. It is easy to stop seeing, and nothing forces a restart unless your admin has set that up.

Microsoft Edge users

Edge runs on Chromium, the same open-source engine, so it inherits most of the same bugs. Microsoft releases its own fix on its own timetable, and had not shipped it when we checked on 28 October.

Brave, Opera, Vivaldi and other Chromium browsers

These also take Chromium's code and repackage it. Each publishes its own version numbers, so the Chrome figure does not apply. Check the maker's release notes for a build that includes the October Chromium security fixes.

Phones and tablets

Chrome for Android 156.0.8078.73 came out on 27 October, and Google says Android releases carry the same security fixes as the desktop ones. It reaches phones through Google Play over a few days. We have not seen a matching statement for iPhone. Keep automatic app updates on for both.

What to do

Six steps, most of them a single click

The first two take a minute per computer. The third is how you know it actually happened across the team.

Check the version on your own machine

Type chrome://settings/help into the address bar, or open the three-dot menu and choose Help, then About Google Chrome. Chrome checks for updates as soon as that page opens. You want 156.0.8078.73 or a higher number.

Relaunch, and let the tabs come back

If the About page says an update is ready, press Relaunch. Chrome reopens the windows and tabs you had, so the cost is about thirty seconds. Save anything typed into a web form first, since a half-written email or form may not survive.

Ask every member of staff to do the same

Send a short message today with the two steps above and ask each person to reply with the number they see. On a small team that is quicker than any tool, and the replies give you a record of which machines are done. Chase anyone still below 156.0.8078.73 by the end of the week.

Make the restart automatic if you use Google Workspace

If your staff sign in to Chrome with managed work accounts, the Google Admin console can prompt or force the restart. Under Devices, Chrome, Settings, find Relaunch notification in the Chrome updates section and choose Force relaunch after a period. Google's default period is seven days; a shorter one closes the gap faster.

Update Edge and any other browser installed

Many Windows PCs have Edge open in the background even when staff prefer Chrome. In Edge, go to edge://settings/help once Microsoft's release is out and restart it too. Do the same for Brave, Opera or Vivaldi from their own About pages, comparing against each maker's notes rather than Chrome's number.

Retire machines that cannot take the update

A computer stuck on an old Chrome, because its operating system is no longer supported, will keep missing fixes like these every month. Make a list of any machine that will not reach 156, and plan to replace or upgrade it rather than leaving it on the network indefinitely.

Keeping it in proportion

Why this is a restart, not a panic

Google is open about the releases where attackers got there first: the post names the bug and says an exploit exists in the wild. This one does not. A score of 8.8 on a CVE feed describes how bad a bug could be in the worst case, not whether anyone has built a working attack, and for browser flaws that usually also takes a second bug to escape the sandbox.

The long list is partly a sign of more people, and more automated tools, hunting for these bugs. Google's own teams reported many of the 52, and eight are credited to researchers at Anthropic. Bugs found and fixed before anyone uses them are the system working. The risk sits with the machines that keep running last month's version after the details become public.

So the useful habit is not watching CVE accounts. It is a browser that restarts within a few days of every update, on every computer, without anyone having to remember. For a small team that is a policy setting or a weekly reminder, and either is better than a scramble.

FAQ

Chrome update questions

What is the latest version of Chrome after the October 2026 security update?

Google's Stable Channel Update for Desktop on 27 October 2026 moved Chrome to 156.0.8078.73 or 156.0.8078.74 on Windows and Mac, and 156.0.8078.73 on Linux. The update rolls out gradually over several days or weeks, so open Help, then About Google Chrome, to fetch it straight away.

Are any of the 52 Chrome flaws being exploited?

Not according to Google. When Chrome patches a flaw that is already being used in attacks, the release post says Google is aware an exploit exists in the wild. The 27 October post says no such thing, and none of the 52 was on the US CISA list of known exploited vulnerabilities when we checked on 28 October 2026.

What is CVE-2026-118320?

A High-severity memory corruption bug in V8, the engine that runs JavaScript inside Chrome. The CVE record says a remote attacker could potentially run code inside Chrome's sandbox using a crafted web page. It was reported by Google's own researchers on 2 October 2026 and fixed in Chrome 156.0.8078.73.

Does Chrome update itself?

It downloads updates by itself, but the new version only takes effect when Chrome is closed and reopened. Until then the old, unpatched version keeps running. That is why a machine can show the update as downloaded for days while still being exposed.

Is Microsoft Edge affected by the same Chrome flaws?

Edge is built on Chromium, the same open-source code as Chrome, so it usually shares these bugs. On 27 October 2026 Microsoft said it was aware of the recent Chromium security fixes and was working on a release. Edge's stable version was still 156.0.4314.42 from 22 October when we checked. Update Edge as soon as Microsoft's release appears.

How do I make staff restart Chrome?

Without management, ask them and check the version they report back. If your business uses Google Workspace or Chrome Enterprise, the Admin console has a Relaunch notification setting under Chrome updates, with options to show a notification recommending a relaunch or to force a relaunch after a period. Google's default period is 168 hours, seven days.

References