Chrome 156 fixes WebRTC, V8 and SVG flaws (CVE-2026-118328)

Google fixed five Chrome flaws, including CVE-2026-118310 and CVE-2026-118316 (both CVSS 9.6), in Chrome 156.0.8078.73, released on October 27, 2026. All five are improper input validation bugs that a remote attacker can trigger with a crafted web page. No exploitation of any of them has been reported. This is the Chrome WebRTC vulnerability CVE-2026-118328 and its four siblings, and Chromium-based Microsoft Edge is tracked for the same CVEs, according to Microsoft’s Security Response Center.

What happened

The Chrome Stable Channel update for desktop, dated October 27, 2026, fixes a batch of memory-safety-adjacent input handling bugs. The five CVEs covered here are CVE-2026-118304, CVE-2026-118310, CVE-2026-118315, CVE-2026-118316 and CVE-2026-118328. NVD lists each as CWE-20, improper input validation, and Chromium rates each as “High” severity.

Microsoft’s update guide carries entries for the same CVEs and notes that Edge (Chromium-based) ingests the Chromium fixes. The Edge entries point back to Google’s release notes for details.

Am I affected?

NVD lists Google Chrome versions earlier than 156.0.8078.73 as affected, and 156.0.8078.73 as the fixed version.

• Google Chrome before 156.0.8078.73: affected by all five CVEs.
• CVE-2026-118310 is described as affecting Chrome on Windows specifically.
• Microsoft Edge (Chromium-based): Microsoft says it ingests the Chromium fixes. The Edge version that carries them has not been published alongside these CVEs, so check Microsoft’s update guide for the build number.

Technical details

All five use a network attack vector with low complexity, no privileges and user interaction required, meaning the victim has to load a crafted page. The 8.8 scored bugs have unchanged scope. The 9.6 scored bugs carry a changed scope, which matches NVD’s wording that they allow code execution outside the sandbox. The sandbox is Chrome’s isolation layer, so code running outside it reaches the operating system directly rather than staying contained in the browser process.

Exploitation status: the vendor has not said that any of the five is exploited, and no public proof of concept has been reported.

Why this matters

This section is our analysis, not new reporting. Browser flaws that need only a page visit are a common first step in intrusions, because users open untrusted links all day. The two 9.6 issues are the more serious pair: V8 is Chrome’s JavaScript engine and is reachable from almost any site, and a path outside the sandbox removes the main barrier a normal renderer bug would face.

The 8.8 issues in SVG and WebRTC would normally need a second bug to escape the sandbox, which lowers practical risk. They still deserve the same patch window, since the fix is one version bump. With no reported exploitation, a prompt rollout within days is a reasonable priority. If exploitation is reported later, treat it as an emergency.

What to do

1. Update Google Chrome to 156.0.8078.73 or later on every desktop. Open the About Chrome page to trigger the update, then relaunch the browser, since the fix does not apply until restart.
2. Check your managed fleet for machines still on older builds. Browser version reporting in your endpoint management tool is the quickest way to find stragglers, especially laptops that rarely restart Chrome.
3. For Microsoft Edge, follow Microsoft’s update guide entries for the five CVEs and confirm the Edge build that includes the Chromium fixes.
4. Remember other Chromium-based browsers and embedded apps. Their versions have not been published, so check each vendor’s own advisory.
5. Tell users not to postpone the restart prompt, and consider enforcing a relaunch deadline through policy.

Detection and hunting ideas

No indicators of compromise have been published for these flaws. Useful checks that follow from the facts:

• Inventory Chrome and Edge versions and flag anything below the fixed build.
• Watch for browser processes spawning unexpected child processes such as shells or scripting hosts, which is the typical sign of a sandbox escape.
• Review proxy and DNS logs for users who reached newly registered or uncategorised domains shortly before such process activity.

Primary sources: the Chrome Releases post and the NVD entries, for example CVE-2026-118328.

Related coverage

• Windows Error Reporting RCE flaw CVE-2026-83519 rated 9.8
• Exchange Server CVE-2026-96940: mailbox access flaw patched

Sources

• Chrome Releases: Stable Channel Update for Desktop (Oct 27, 2026)
• NVD: CVE-2026-118328
• Microsoft Security Update Guide: CVE-2026-118328