chrome://settings/help on the PC - not a claim that a page you opened yesterday owned you.
chrome://settings/help in the address bar, wait until it says it is up to date, read 156.0.8078.73 or .74, then Relaunch. Firefox-only and Safari-only people can stop. iPhone Chrome uses WebKit; this Android/desktop Chromium CVE is not that app.
What Broke, in Plain Language
Chrome's sandbox is the box that is supposed to keep a bad page away from the rest of the phone. Google's own CVE text for CVE-2026-118321: improper input validation in Core, Chrome on Android prior to 156.0.8078.73, a remote attacker, a crafted HTML page, potentially execute code outside the sandbox. Chromium severity: High.
A second High bug in the same wave, CVE-2026-118314, is UI / inside-the-sandbox code execution on Android below the same build. You do not need two procedures. One Chrome version covers both.
Desktop Stable the same Tuesday: 156.0.8078.73/.74 on Windows and Mac, .73 on Linux. Google's Android note: Android releases carry the same security fixes as the matching desktop build unless they say otherwise. Secondary write-ups counted 52 security fixes in that desktop drop, four of them Critical. We are not going to invent "zero-day in the wild." CISA's KEV catalog does not list 118321. Google did not, in the public CVE line, claim exploitation. Patch anyway. Visiting a page is the whole vector - there is no attachment to refuse.
This is not SMS of Death. That was the radio stack and a 2026-10-01 Android security date. Chrome is an app. A phone can show October's OS patch and still run Chrome 155.
Who This Actually Hits
| Setup | In scope? | Why |
|---|---|---|
| Chrome on Android, version below 156.0.8078.73 | Yes | CVE-2026-118321 / 118314 named Android |
| Chrome on Windows/Mac/Linux below 156.0.8078.73 (.74 is fine) | Yes for the 27 Oct desktop package | Same Tuesday; same Chromium floor |
| Chrome 156.0.8078.73 or newer | Check once, then stop | This wave is in |
| Edge / Brave / Opera still on old Chromium | Update those apps too | They lag Chrome; their About page is the score |
| Safari on iPhone, Firefox-only, Samsung Internet without Chrome installed | Not these two CVEs as written | Different engine. Don't skip OS updates; this article is Chrome's number |
U.S. readers who "already updated Android" after the SMS of Death patch check still need this tap. Play Store Chrome is not the monthly security date under About phone.
The Two-Minute Check
- Phone. Play Store → Google Chrome → Update. Open Chrome → three dots → Settings → About Chrome. Write the number. Below 156.0.8078.73 = not done. Auto-update in Play does nothing if you never open Chrome after the download; open it once.
- PC. Address bar:
chrome://settings/help. Let it finish. Relaunch when it asks. A yellow "pending update" on the menu is not patched until you relaunch. - Work laptop with Edge only.
edge://settings/help. You want a Chromium base at or above this week's Chrome floor, not "Edge says up to date" from last month. If Edge's About is still 155, wait for Microsoft's channel or use Chrome for the day. - Stop. No "Chrome cleaner" APKs. No resetting the phone. If Play Store has no Update button and About already shows 156.0.8078.73+, you are done for this CVE.
| What you see | Status | Next step |
|---|---|---|
| 156.0.8078.73 or .74 or newer | This wave patched | Done. Keep auto-update on |
| 156.0.8078.47 / .48 (the 20 Oct Stable) | Missing the 27 Oct security drop | Help page + relaunch, or Play Update |
| Chrome 155 or older | Affected | Update now, then open About again |
| Android 7 or older, Chrome cannot install 156 | No official fix | Stop using that Chrome for banking; the OS is out of support |
After You Update
Google has not told you to rotate passwords solely because you were on 155. If a page already felt wrong this week - fake overlay, extension you did not add - treat it as a normal account incident, not as proof of 118321. Mailbox follow-up if needed: 15-minute mailbox audit.
Work Microsoft accounts on the same Android are still the Authenticator build check. That app is not Chrome.
Takeaways
- Android Chrome below 156.0.8078.73: High, crafted page, code outside the sandbox (CVE-2026-118321).
- OS October patch ≠ Chrome patch.
- Not listed as exploited in KEV. Still update. Relaunch / open the app or the bits sit unused.
- No cleaner APK. No PoC on this page.
FAQ
I only use the phone's "Internet" icon, not the Chrome icon. Many OEMs still ship Chrome as that icon, or ship a separate Chromium skin. If Play Store shows Google Chrome installed, update it. If the browser is purely something else, this CVE page does not apply - still keep that browser's store listing current.
Will this drain battery / change my tabs? A point-release. Restart Chrome. Tabs usually restore.
Enterprise policy blocks Chrome updates. That is an admin problem, not a Settings trick. Show them 156.0.8078.73 and CVE-2026-118321.
Is Brave safer until I update Chrome? Only if Brave's own build is already on this Chromium floor. An old Brave is the same class of bug, delayed.
Sources
- Chrome Releases - Stable Channel Update for Desktop (27 Oct 2026)
- Chrome Releases - Chrome for Android Update (27 Oct 2026)
- CVE.org - CVE-2026-118321
- CVE.org - CVE-2026-118314
Changelog. October 31, 2026 - Initial publication: two-minute Chrome 156.0.8078.73 check; Android outside-sandbox CVE; OS patch vs app; no in-the-wild claim.
Comments
Comments
Post a Comment