Zero Radar
← feed
CriticalVulnerabilityCVE-2026-76025updated 30 Oct 2026, 01:17 UTC

Google Chrome: flaw in file handling lets crafted web pages run code

A weakness in how Chrome manages memory when it handles files can be abused by a malicious web page. Someone could trick you into visiting that page and run code on your computer inside Chrome's protective sandbox.

Fix availableOfficial, 2 sources
SeverityCriticalCVSS 8.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesGoogle Chrome 156.0.8078.79 (Linux) and 156.0.8078.79/.80 (Windows and Mac) on the Stable and Extended Stable channels. · since 29 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker builds pagePage crafted to trigger the file bug
  2. 2Victim opens pageChrome loads the malicious HTML
  3. 3Memory misusedFreed file object is reused by attacker
  4. 4Code runs in sandboxAttacker code executes inside browser sandbox
  5. ResultAttacker runs code inside Chrome's sandbox

What happened

A use-after-free bug in the FileSystem component of Google Chrome before 156.0.8078.79 lets a remote attacker execute arbitrary code inside the sandbox via a crafted HTML page.

Why it is dangerous: Anyone who browses the web with an unpatched Chrome can be targeted just by opening a malicious page, which can lead to code running on the device and data being exposed.

Are you affected?

You are affected if you run Google Chrome earlier than 156.0.8078.79 on Windows, Mac, or Linux.

Google Chrome prior to 156.0.8078.79 (Windows and Mac: 156.0.8078.79/.80 is the fixed Stable build; Linux: 156.0.8078.79).

What to do

  1. Update Google Chrome to 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac).
  2. Fully restart Chrome after the update so the new version is running.
  3. Check the Chrome version under Help > About Google Chrome to confirm the update applied.

Timeline

  1. 29 Oct 2026, 21:26 UTC
    Publicly disclosed
  2. 29 Oct 2026, 21:26 UTC
    Reported by Google Chrome · Google Chrome
  3. 29 Oct 2026, 23:07 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 01:17 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-76025
CVSS
8.8 / 10
Disclosed
29 Oct 2026, 21:26 UTC
On Zero Radar
29 Oct 2026, 23:07 UTC (2 h after disclosure)
Last change
30 Oct 2026, 01:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Google Chrome: flaw in file handling lets crafted web pages run code · Zero Radar