Zero Radar
← feed
HighVulnerabilityupdated 29 Oct 2026, 15:09 UTC

Google Chrome: several flaws allow attackers to run code and take control

Attackers could exploit several bugs in Google Chrome to run harmful code on your computer, gain extra access, or steal or change data. Updating Chrome closes these holes.

Fix availableOfficial, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesUpdated Chrome release referenced by the advisories; exact fixed version not stated in the material. · since 29 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

What happened

Multiple Chromium-based vulnerabilities affect Google Chrome, including buffer overflows in V8 and WebRTC, race conditions and type confusion in ANGLE, incomplete cleanup in SiteIsolation, improper input validation in Media, incorrect authorization in Downloads, and information leaks in Paint and QUIC.

Why it is dangerous: Successful exploitation could allow arbitrary code execution, privilege escalation, security bypass, data disclosure or manipulation, or denial of service. Anyone who browses the web with an unpatched Chrome is at risk.

Are you affected?

You are affected if you use Google Chrome (or another Chromium-based browser) that has not received the latest security update.

Google Chrome, versions prior to the security update referenced in the advisories (exact version numbers not stated in the material).

What to do

  1. Update Google Chrome to the latest version via Settings > About Google Chrome
  2. Restart the browser after the update to apply the fix
  3. Ensure other Chromium-based browsers (Edge, Brave, Opera) are also updated

Timeline

  1. 28 Oct 2026, 08:41 UTC
    Publicly disclosed
  2. 28 Oct 2026, 08:41 UTC
    Reported by Microsoft MSRC · Microsoft MSRC
  3. 28 Oct 2026, 08:41 UTC
    Reported by Microsoft MSRC · Microsoft MSRC
  4. 28 Oct 2026, 08:42 UTC
    Reported by Microsoft MSRC · Microsoft MSRC
  5. 28 Oct 2026, 08:42 UTC
    Reported by Microsoft MSRC · Microsoft MSRC
  6. 28 Oct 2026, 08:42 UTC
    Reported by Microsoft MSRC · Microsoft MSRC
  7. 28 Oct 2026, 08:42 UTC
    Reported by Microsoft MSRC · Microsoft MSRC
  8. 28 Oct 2026, 08:42 UTC
    Reported by Microsoft MSRC · Microsoft MSRC
  9. 28 Oct 2026, 08:42 UTC
    Reported by Microsoft MSRC · Microsoft MSRC
  10. 28 Oct 2026, 08:42 UTC
    Reported by Microsoft MSRC · Microsoft MSRC
  11. 29 Oct 2026, 12:55 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  12. 29 Oct 2026, 12:58 UTC
    Picked up by Zero Radar
  13. 29 Oct 2026, 15:09 UTC
    Microsoft MSRC reported on it · Microsoft MSRC

Sources 11 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
ZR-51a85a85
Disclosed
28 Oct 2026, 08:41 UTC
On Zero Radar
29 Oct 2026, 12:58 UTC (28 h after disclosure)
Last change
29 Oct 2026, 15:09 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Google Chrome: several flaws allow attackers to run code and take control · Zero Radar