CriticalVulnerabilityCVE-2026-76028updated 30 Oct 2026, 01:17 UTC

Google Chrome: flaw in file handling lets crafted web pages run code

A bug in how Chrome handles files can be abused by a malicious web page to run harmful code on your computer. Updating Chrome closes the hole.

Fix availableOfficial, 2 sources

Severity	CriticalCVSS 8.8 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	YesGoogle Chrome 156.0.8078.79 (Linux) and 156.0.8078.79/.80 (Windows and Mac) · since 29 Oct 2026
How sure is this?	Official, 2 sourcesBacked by an official source

How the attack works simplified

1Attacker builds pageCrafted HTML page with exploit
2User visits pageLured via link or ad
3Chrome FileSystem bugUse after free is triggered
4Code runs in sandboxArbitrary code execution
ResultAttacker runs code inside browser sandbox

What happened

A use-after-free bug in the FileSystem component of Google Chrome prior to 156.0.8078.79 allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page.

Why it is dangerous: An attacker only needs to lure a user to a malicious web page; the browser's sandbox limits the damage, but code execution is still possible. Anyone using an unpatched Chrome installation is at risk.

Are you affected?

You are affected if you run Google Chrome on Windows, Mac, or Linux at a version earlier than 156.0.8078.79 (Windows/Mac 156.0.8078.79/.80).

Google Chrome Stable and Extended Stable channels prior to 156.0.8078.79 (Windows, Mac, Linux)

What to do

Update Google Chrome to 156.0.8078.79 or later (Windows/Mac 156.0.8078.79/.80)
Restart the browser after the update to apply the fix
Check Help > About Google Chrome to confirm the version

Timeline

29 Oct 2026, 21:26 UTC
Publicly disclosed
29 Oct 2026, 21:26 UTC
Reported by Google Chrome · Google Chrome
29 Oct 2026, 23:07 UTC
Picked up by Zero Radar
30 Oct 2026, 01:17 UTC
NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Stable Channel Update for DesktopGoogle Chrome · 29 Oct 2026, 21:26 UTC
CVE-2026-76028NVD · 30 Oct 2026, 01:16 UTC

Technical details

ID: CVE-2026-76028
CVSS: 8.8 / 10
Disclosed: 29 Oct 2026, 21:26 UTC
On Zero Radar: 29 Oct 2026, 23:07 UTC (2 h after disclosure)
Last change: 30 Oct 2026, 01:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works