Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN1105 _____________________________________________________________________ DATE : 29/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Google Chrome versions prior to 156.0.8078.73/.74. ==================================================================== https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html _____________________________________________________________________ Stable Channel Update for Desktop Tuesday, October 27, 2026 The Stable channel has been updated to 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security Fixes and Rewards Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed. This update includes 52 security fixes. Please see the Chrome Security Page for more information. [N/A][571156746] Critical CVE-2026-118306: Memory corruption in FileSystem. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-10-07 [TBD][572193211] Critical CVE-2026-118331: Improper input validation in FileAPI. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-10-11 [N/A][574776938] Critical CVE-2026-118348: Improper input validation in Skia. Reported by Xinyang Ge on 2026-10-17 [N/A][574852698] Critical CVE-2026-118344: Use after free in Layout. Reported by Xinyang Ge on 2026-10-17 [N/A][562191732] High CVE-2026-118357: Use after free in FileSystem. Reported by Xinyang Ge on 2026-09-16 [TBD][565133743] High CVE-2026-118318: Improper access control in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-09-23 [N/A][567129324] High CVE-2026-118350: Use after free in Turbolev. Reported by OpenAI Codex Security (amyb) on 2026-09-28 [N/A][567645136] High CVE-2026-118339: Use after free in Animation. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-30 [N/A][568348290] High CVE-2026-118305: Memory corruption in Turbolev. Reported by Google on 2026-10-02 [N/A][568730797] High CVE-2026-118317: Memory corruption in HTML. Reported by Xinyang Ge on 2026-10-02 [N/A][568894515] High CVE-2026-118320: Memory corruption in V8. Reported by Google on 2026-10-02 [N/A][568895029] High CVE-2026-118322: Memory corruption in ANGLE. Reported by Google on 2026-10-02 [N/A][568900535] High CVE-2026-118329: Improper input validation in ANGLE. Reported by Google on 2026-10-02 [N/A][568936430] High CVE-2026-118354: Improper input validation in Skia. Reported by Google on 2026-10-03 [N/A][568936530] High CVE-2026-118340: Memory corruption in Skia. Reported by Google on 2026-10-03 [N/A][568937139] High CVE-2026-118321: Improper input validation in Core. Reported by Google on 2026-10-03 [N/A][569286605] High CVE-2026-118337: Improper access control in Forms. Reported by Xinyang Ge on 2026-10-05 [N/A][569674221] High CVE-2026-118352: Memory corruption in Cache. Reported by Xinyang Ge on 2026-10-05 [N/A][570638833] High CVE-2026-118355: Improper input validation in Command. Reported by Xinyang Ge on 2026-10-06 [N/A][570675085] High CVE-2026-118307: Use after free in Paint. Reported by Xinyang Ge on 2026-10-06 [N/A][570825067] High CVE-2026-118351: Memory corruption in Skia. Reported by Xinyang Ge on 2026-10-07 [TBD][570927027] High CVE-2026-118328: Improper input validation in WebRTC. Reported by Mozilla on 2026-10-07 [N/A][571147583] High CVE-2026-118333: Missing authorization in Video. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-10-07 [TBD][572111820] High CVE-2026-118336: Improper input validation in Headless. Reported by Anonymous on 2026-10-10 [N/A][572191610] High CVE-2026-118358: Memory corruption in WebAudio. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-10-10 [TBD][572312175] High CVE-2026-118353: Use after free in Paint. Reported by Anthropic and Ada Logics on 2026-10-10 [N/A][572422506] High CVE-2026-118349: Memory corruption in Payments. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-10-11 [TBD][572878518] High CVE-2026-118327: Memory corruption in Media. Reported by Please attribute Anthropic and Ada Logics. on 2026-10-12 [TBD][573378812] High CVE-2026-118359: Memory corruption in V8. Reported by zenneth (randomguy6407) on 2026-10-14 [TBD][573389782] High CVE-2026-118343: Improper input validation in ReadingList. Reported by malichamdan on 2026-10-14 [TBD][573938968] High CVE-2026-118311: Memory corruption in Media. Reported by secbuddy(Ben) on 2026-10-15 [N/A][574027204] High CVE-2026-118334: Use after free in ImageCapture. Reported by OpenAI Codex Security (kylebot) on 2026-10-15 [TBD][574030524] High CVE-2026-118332: Improper input validation in Compositing. Reported by e7be95afd6e4ad8d8abc6076c284c79db9e35cc2 on 2026-10-15 [N/A][574032795] High CVE-2026-118313: Use after free in Video. Reported by OpenAI Codex Security (kylebot) on 2026-10-15 [N/A][574061024] High CVE-2026-118345: Use after free in PDFium. Reported by OpenAI Codex Security (kylebot) on 2026-10-15 [TBD][574101376] High CVE-2026-118304: Improper input validation in SVG. Reported by Arni Hardarson (Neonix Security) on 2026-10-15 [N/A][574223268] High CVE-2026-118316: Improper input validation in V8. Reported by Google on 2026-10-16 [N/A][574382050] High CVE-2026-118346: Use after free in Compositing. Reported by Google on 2026-10-16 [N/A][574412629] High CVE-2026-118342: Out of bounds write in Editing. Reported by Google on 2026-10-16 [N/A][574516887] High CVE-2026-118310: Improper input validation in Views. Reported by Google on 2026-10-16 [N/A][574606539] High CVE-2026-118335: Improper input validation in Metrics. Reported by Google on 2026-10-16 [N/A][574791952] High CVE-2026-118308: Use after free in SVG. Reported by Google on 2026-10-17 [N/A][574803484] High CVE-2026-118314: Improper input validation in UI. Reported by Google on 2026-10-17 [N/A][574911589] High CVE-2026-118347: Use after free in FileSystem. Reported by Google on 2026-10-17 [N/A][574911701] High CVE-2026-118341: Use after free in Modularization. Reported by Google on 2026-10-17 [N/A][575090745] High CVE-2026-118330: Use after free in Browser. Reported by Google on 2026-10-18 [TBD][575184164] High CVE-2026-118315: Improper input validation in SVG. Reported by Arni Hardarson (Neonix Security) on 2026-10-18 [TBD][575851252] High CVE-2026-118356: Use after free in WTF. Reported by malichamdan on 2026-10-20 [N/A][576133777] High CVE-2026-118309: Improper input validation in UI. Reported by Google on 2026-10-21 [N/A][576194994] High CVE-2026-118319: Memory corruption in Skia. Reported by Xinyang Ge on 2026-10-21 [N/A][540025369] Medium CVE-2026-118312: Memory corruption in Paint. Reported by Google on 2026-07-28 [N/A][575826638] Medium CVE-2026-118338: Use after free in Animation. Reported by flapjack-security-bugs-access on 2026-10-20 We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel. Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.. Srinivas Sista Google Chrome ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================