# Chromium 156 stable fixes 52 security flaws, including four critical CVEs

> **Key takeaway:** Google shipped Chromium 156.0.8078.73 with 52 security patches, four of them critical, including multiple memory corruption and use-after-free vulnerabilities in FileSystem, FileAPI, Skia, and Layout subsystems.

**Published:** 2026-10-27T23:02:38.722000+00:00 
**Source:** Google Chromium Engineering Releases 
**Category:** bigtech-foss 
**Canonical URL:** https://fosswire.org/news/chromium-156-stable-fixes-52-security-flaws-including-four-c.html 

## Summary
Google has promoted Chromium 156.0.8078.73 to the Stable channel for Linux, with builds .73 and .74 for Windows and macOS. The release contains 52 security fixes, four rated Critical and the remainder High severity. The critical vulnerabilities span memory corruption in FileSystem (CVE-2026-118306), improper input validation in FileAPI (CVE-2026-118331) and Skia (CVE-2026-118348), and a use-after-free in Layout (CVE-2026-118344). Multiple High-severity flaws affect core rendering and JavaScript components including V8, Turbolev, ANGLE, and WebRTC.

Notably, a substantial portion of the reported vulnerabilities came from external security researchers, with Anthropic's Xinyang Ge credited on numerous CVEs and OpenAI's Codex Security team also contributing. Several entries explicitly note assistance from AI systems including Claude. As is standard practice, Google is withholding full bug details and exploit links until most users have received the update, and will maintain restrictions where third-party libraries remain unfixed.

## Security fix breakdown and affected subsystems
- **Critical severity:** Four CVEs rated Critical affect FileSystem (memory corruption), FileAPI (improper input validation), Skia (improper input validation), and Layout (use-after-free), all representing remotely exploitable attack surface in core browser functionality.
- **V8 and JavaScript engine:** Multiple High-severity fixes target V8 (improper access control, memory corruption) and Turbolev (use-after-free, memory corruption), the optimizing compiler pipeline introduced in recent Chromium generations.
- **Graphics and media stack:** Skia receives four separate patches for memory corruption and input validation flaws; ANGLE gets two fixes for memory corruption and input validation; WebAudio, Media, and Video components also received High-severity patches.
- **External AI-assisted disclosure:** A significant cluster of reports originated from Anthropic researcher Xinyang Ge, with explicit attribution to Claude for assistance on CVE-2026-118306, CVE-2026-118331, CVE-2026-118339, CVE-2026-118333, CVE-2026-118358, and CVE-2026-118349, plus OpenAI Codex Security for CVE-2026-118350.
- **Embargo policy:** Google is restricting access to bug details and links pending majority user update adoption, with extended holds for vulnerabilities in third-party libraries that other downstream projects have not yet patched.

## Why it matters
Linux distributions packaging Chromium and derived browsers including Brave, Vivaldi, and Microsoft Edge will need to expedite their rebuilds and security updates to incorporate these 52 fixes, particularly the four critical CVEs affecting widely used subsystems like FileSystem and Skia. The concentration of AI-assisted vulnerability discovery from Anthropic and OpenAI signals a maturing trend in automated security research that upstream maintainers and distro security teams should anticipate in future disclosure cycles.