Chrome 2026-10-27 修補 52 個漏洞，四個關鍵漏洞影響檔案處理、圖形渲染與頁面佈局
Google Chrome Patches Four Critical Vulnerabilities in Major Security Update
Chrome 2026-10-27 發布安全更新，修補 52 個漏洞，其中四個被評為關鍵，影響檔案處理、圖形渲染與頁面佈局。
Chrome 2026-10-27 修補 52 個漏洞，其中四個關鍵漏洞影響檔案處理、圖形渲染與頁面佈局，建議即時升級以降低風險。
Google has released a significant security update for Chrome desktop, addressing 52 vulnerabilities, including four rated Critical. Released on October 27, 2026, the update covers Windows, macOS, and Linux.
The release deserves attention because several vulnerabilities affect components involved in file handling, graphics rendering, and page layout. These components process content that browsers routinely receive from websites and web applications.
Google’s security release identifies the following Critical vulnerabilities.
- CVE-2026-118306 — FileSystem: Memory corruption.
- CVE-2026-118331 — FileAPI: Improper input validation.
- CVE-2026-118348 — Skia: Improper input validation.
- CVE-2026-118344 — Layout: Use-after-free.
These weaknesses affect different parts of Chrome’s processing pipeline, making it important to understand the underlying technical risks.
1. CVE-2026-118306: Memory Corruption in FileSystem
Memory corruption occurs when software incorrectly modifies or accesses memory. Depending on the conditions, this can cause application instability or potentially provide an avenue for code execution.
The vulnerability affects Chrome’s FileSystem component. Because browser file-handling functionality interacts with content and resources, memory-safety defects in this area warrant prompt remediation.
Google has not publicly disclosed sufficient technical details to establish a reliable exploitation scenario. The precise impact should therefore not be overstated.
2. CVE-2026-118331: Improper Input Validation in FileAPI
Input validation ensures that data meets the requirements expected by the receiving component.
A validation failure can allow malformed or unexpected input to reach code that is not designed to handle it safely. The resulting consequences depend on the affected code path and the safeguards surrounding it.
This vulnerability affects FileAPI, making it another reason to prioritise the update rather than rely on browser isolation alone.
3. CVE-2026-118348: Improper Input Validation in Skia
Skia is a graphics engine used by Chromium-based browsers to render visual content.
Graphics processing is a security-sensitive area because browsers routinely handle complex images, shapes, and other rendered objects. Improper validation can expose weaknesses in how the software processes such input.
The vulnerability’s exact attack requirements and impact have not been fully established in the publicly available release information.
4. CVE-2026-118344: Use-After-Free in Layout
A use-after-free vulnerability occurs when a program continues to access memory after that memory has been released.
In a browser, such defects can potentially result in crashes, memory corruption, or code execution, depending on exploitability and the surrounding security controls.
The affected component is Layout, which participates in processing and arranging web-page content. This makes the flaw particularly relevant to browser security, although the available information does not establish that visiting a particular page is sufficient to exploit it.
Additional High-Severity Vulnerabilities
The release also addresses several High-severity issues.
- CVE-2026-118357: Use-after-free in FileSystem.
- CVE-2026-118318: Improper access control in V8.
- CVE-2026-118350: Use-after-free in Turbolev.
- CVE-2026-118308: Use-after-free in SVG.
- CVE-2026-118347: Use-after-free in FileSystem.
These issues demonstrate that the update extends beyond the four Critical findings. Memory-safety weaknesses across different browser components can create multiple potential avenues for compromise.
Google has restricted access to some vulnerability details while users receive the fixes. This limits the technical information currently available for assessing individual exploitation scenarios.
Affected Versions and Remediation
The October 27 Stable Channel update identifies these versions:
- Windows: Chrome 156.0.8078.73 or 156.0.8078.74.
- macOS: Chrome 156.0.8078.73 or 156.0.8078.74.
- Linux: Chrome 156.0.8078.73.
Google is rolling out the update progressively, so availability may vary between devices.
The immediate priority is straightforward: update Chrome, verify the fix, and ensure that unmanaged endpoints do not remain behind.