Google fixes 52 Chrome flaws, including four critical bugs
Stable builds move to 156.0.8078.73/.74 on Windows and Mac and 156.0.8078.73 on Linux, with no exploitation stated.
68
CVE-2026-118318
Improper access control (memory read) in Chrome V8 before 156.0.8078.73
- CVSS 3.1
- 4.3 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An improper access control flaw in Chrome's V8 JavaScript engine lets a remote attacker read browser memory by getting a user to visit a crafted HTML page. No authentication beyond page load is required. Successful exploitation can expose sensitive process memory to the attacker. Chrome releases before 156.0.8078.73 are affected.
What to do: Update Chrome to version 156.0.8078.73 or later; Chrome's auto-update should apply the fix after relaunch.
| Product | Affected | Fixed in |
|---|---|---|
| Google Chrome | prior to 156.0.8078.73 | 156.0.8078.73 |
Estimated exposure
massTens of millions of unpatched users at most — Chrome's dominant browser share; auto-update limits the unpatched share, so figures are imprecise.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)