Google Chrome 156 security updates: CVE-2026-76024 and five critical flaws, version to install
Google Chrome 156: two late-October 2026 updates fix five critical flaws, including CVE-2026-76024 (maCERT). Versions to install, Edge and fleet checks.
The short answer: on 27 October 2026 and then 29 October 2026, Google released two desktop updates for Chrome 156. They fix 52 and then 21 security flaws, five of them rated critical by Google, including CVE-2026-76024 (memory corruption in MediaStream). Morocco’s maCERT (DGSSI) published bulletin 70283010/26 on 30 October, with an “important” risk level. Google reports no active exploitation. Update Chrome to 156.0.8078.79 (or .80) and Microsoft Edge to 156.0.4314.58, then check that browsers have actually restarted.
The browser is the most exposed application on a workstation: every day it opens websites, attachments and links received by email. In businesses in Morocco, Chrome and Edge run on almost every PC, and a browser left open for days does not apply its updates. Here is what Google, Microsoft and maCERT say, and what to do.
What is fixed
The two release notes published on the Chrome Releases blog list the fixed flaws and their severity as rated by Google. The five critical flaws are:
- CVE-2026-76024: memory corruption in MediaStream (29 October update);
- CVE-2026-118306: memory corruption in FileSystem (27 October);
- CVE-2026-118331: improper input validation in FileAPI (27 October);
- CVE-2026-118348: improper input validation in Skia (27 October);
- CVE-2026-118344: use after free in Layout (27 October).
The other flaws are rated high or medium. They affect, among others, the V8 JavaScript engine, the Skia graphics library, ANGLE, WebRTC, the PDFium reader and the browser’s file system. As usual, Google keeps technical details restricted until most users have the fix, and its release notes do not publish CVSS scores.
maCERT’s bulletin sums up the stakes: exploiting these vulnerabilities may allow an attacker to execute code remotely, access confidential data, bypass security measures or cause a denial of service.
| Product | Affected versions | Fixed version |
|---|---|---|
| Google Chrome for Windows and Mac | earlier than 156.0.8078.79/.80 | 156.0.8078.79/.80 |
| Google Chrome for Linux | earlier than 156.0.8078.79 | 156.0.8078.79 |
| Google Chrome, Extended Stable channel | earlier than 156.0.8078.79/.80 | 156.0.8078.79/.80 |
| Microsoft Edge (Stable channel) | earlier than 156.0.4314.58 | 156.0.4314.58 |
The 27 October build (156.0.8078.73/.74) already fixed the first 52 flaws. The 29 October build includes them and adds 21 more: that is the one to target.
Exploitation: what is known
- Google: neither release note mentions active exploitation. When a flaw is exploited, Google says so explicitly, which is not the case here.
- CISA KEV catalogue: none of the five critical flaws appears in it as of its 30 October 2026 update.
- maCERT: bulletin 70283010/26 of 30 October 2026 rates both risk and impact as “important” and refers to Google’s bulletin. Bulletin 70420211/26 of 2 November 2026 covers Microsoft Edge before version 156.0.4314.58.
No known exploitation is a reason to handle this calmly, not to postpone it. Once fixes are published, the difference between the old and new code becomes visible, and a fleet that does not update stays exposed.
Microsoft Edge and other Chromium browsers
Edge shares the Chromium engine with Chrome. Microsoft states that on 30 October 2026 it released Stable version 156.0.4314.58, which incorporates the latest Chromium security updates, and that the CVE list will be added to its security release notes. Other Chromium-based browsers (Brave, Opera, Vivaldi…) follow their own vendor’s schedule: if they are allowed on your fleet, check their updates separately.
Interim measures
There is no workaround: the effective measure is the update, followed by a browser restart. If some PCs cannot be updated right away:
- Restrict browsing on those PCs to the sites needed for work, and have any suspicious link reported.
- Keep DNS filtering and EDR active: they do not fix the flaw, but block some malicious sites and abnormal behaviour.
- Remind users not to open unexpected attachments or links, even from a known sender.
Checks to run
- Check the version on a sample of PCs:
chrome://settings/helpfor Chrome,edge://settings/helpfor Edge. The page also starts the update if one is available. - Find browsers that have never restarted: the update downloads in the background but only applies on relaunch.
- Set a relaunch rule through Group Policy or Intune (Chrome and Edge relaunch notification policies), so that fixes apply within a few days.
- Make sure automatic updates are not blocked by an old policy, a proxy or user permissions.
- List browsers installed outside your standard, including portable versions.
- Do not forget smartphones: Google also released Chrome for Android updates in late October, to be pushed through your mobile device management tool.
Our take for businesses in Morocco
Browsers now receive security fixes almost every week. Manual, PC-by-PC handling cannot keep up. The right answer is a policy: automatic updates on, a forced restart after a few days, and a monthly version check in the monitoring report.
To go further, read our business patch management method, our guide to managing and securing Windows PCs with Intune, our article on business DNS filtering, our EDR vs antivirus comparison and our guide to business smartphone management. Last month’s Microsoft fixes are covered in our alert on Microsoft October 2026 patches. For organisations in scope, Law 05-20 and DGSSI requirements mean maCERT bulletins must be acted upon.
How we can help
We inventory the browsers across your fleet, check their versions, configure update and relaunch rules through Group Policy or Intune, and add version checks to our 24/7 monitoring, with critical incidents handled in under 15 minutes. See our approach to business cybersecurity in Morocco, then request your free initial audit: we reply within 24 business hours.
Sources: Google, Stable Channel Update for Desktop of 27 October 2026, Google, Stable Channel Update for Desktop of 29 October 2026, maCERT: bulletin 70283010/26 (Google Chrome), maCERT: bulletin 70420211/26 (Microsoft Edge), Chrome Releases, October 2026 posts (including Chrome for Android), Microsoft, Microsoft Edge security release notes, CISA KEV catalogue, NVD CVE-2026-76024.
Frequently asked questions
Are the flaws fixed in Chrome 156 being exploited?
Google’s release notes of 27 and 29 October 2026 report no active exploitation, unlike other updates where Google states that an exploit exists. None of these flaws appears in the CISA KEV catalogue as updated on 30 October 2026. Five flaws are nonetheless rated critical by Google, which warrants a prompt update.
Which Chrome version should be installed?
According to Google and maCERT bulletin 70283010/26, the reference version is 156.0.8078.79 or .80 on Windows and Mac, and 156.0.8078.79 on Linux. It includes the fixes from the 27 October update (156.0.8078.73/.74). The installed version is shown at chrome://settings/help.
Is Microsoft Edge affected?
Edge is built on Chromium. On 30 October 2026, Microsoft released Stable version 156.0.4314.58, which according to Microsoft incorporates the latest Chromium security updates. On 2 November, maCERT published bulletin 70420211/26, which covers Edge versions earlier than 156.0.4314.58.
Why is Chrome out of date when automatic updates are on?
Chrome downloads the update in the background, but it only applies when the browser restarts. A PC where Chrome stays open for days keeps the old version. In a business, browser relaunch rules are set through Group Policy or Intune.
About the editorial team
ALLSAFE SOLUTIONS
Network, security and cloud engineers
Written by the engineering team at ALLSAFE SOLUTIONS, a managed IT provider founded in Casablanca by network, security and cloud engineers. Our articles draw on the projects we deliver for clients in Morocco and abroad.
LinkedIn
