Chrome Security Alert: CVE-2026-118320 and How to Stay Safe
Alberta Radio | October 28, 2026
Chrome users should check for updates today. Google has confirmed CVE-2026-118320, a high-severity memory-corruption flaw in V8, and included a fix in its October 27 desktop security release.
What is CVE-2026-118320?
V8 runs JavaScript in Chrome. The vulnerability notice supplied for this report describes potential code execution inside the browser sandbox through specially crafted HTML in versions before 156.0.8078.73. In that scenario, visiting a hostile or compromised page could be enough; a separate download or extension would not be necessary.
Code execution inside a sandbox does not by itself establish full control of the computer. Additional weaknesses would generally be needed to escape that boundary. Google’s release notes confirm the V8 flaw and severity, while detailed bug information may remain restricted.
Which Chrome versions contain the fix?
Google’s desktop release lists 156.0.8078.73/.74 for Windows and Mac, and 156.0.8078.73 for Linux. Install the newest supported stable version available for your device, including any later security releases.
Is it being actively exploited?
Google’s October 27 advisory does not announce active exploitation of this specific CVE. That is not proof that exploitation is impossible or has never occurred. This report does not classify the flaw as a confirmed actively exploited zero-day.
How regular users can protect themselves
Start with the patch. The everyday precautions below reduce broader online risks; they do not replace a browser security update.
1. Update Chrome and restart it
On a computer, open Chrome’s three-dot menu, select Help, then About Google Chrome. Let the browser check for updates and select Relaunch when prompted. You can also type chrome://settings/help into Chrome’s address bar. On Linux, use your package manager if required. Save unfinished work first, and revisit the About page after restarting to confirm the update applied.
On Android or iPhone/iPad, check your official app store for Chrome updates. Also install available operating-system updates. Desktop version numbers should not be treated as an iOS patch checklist.
2. Keep Safe Browsing switched on
In Chrome, open Settings, then Privacy and security, then Security. Keep at least Standard protection enabled. Enhanced protection adds checks for emerging dangers, but sends additional browsing-related information to Google; review that privacy trade-off before enabling it. Do not bypass browser warnings. These checks cannot guarantee that every harmful page will be detected.
3. Ignore fake update and virus pop-ups
A webpage telling you to download an urgent browser patch, call a support number, or run a command is a warning sign. Close the page and check for updates through Chrome itself or your device’s official app store. Never paste commands into a terminal because an unfamiliar website tells you to.
4. Review extensions and permissions
Remove extensions you do not recognize or no longer need. Check what remaining extensions can read or change, and revoke unnecessary website notification permissions. Keep your device’s built-in security protection enabled.
5. Protect your accounts
Use unique passwords stored in a reputable password manager, or use passkeys where supported. Enable two-step verification on important accounts and keep recovery information current. Passkeys help resist phishing, but account protection does not patch a vulnerable browser.
6. Keep backups and act on suspicious activity
Back up important files and keep your operating system and other apps updated. If you see unexplained account activity, use a trusted device to secure the account, review signed-in sessions and contact the provider through its official website. For a work or school device, report concerns to your IT team.
A reminder for Alberta households and small businesses
A familiar browser logo does not remove the need for maintenance. Check every device you use for email, banking, business administration and everyday browsing. An update waiting for a restart is unfinished protection.
Sources and further reading
The original notice also promotes a free security assessment from Lucid Security. Alberta Radio has not independently verified that offer.
