Zero Radar
← feed
HighVulnerabilityupdated 28 Oct 2026, 15:31 UTC

Google Chrome and Microsoft Edge: several serious security flaws

Attackers can exploit several bugs in the web browser to run their own code on your computer or steal and change data. Updating the browser closes these holes.

Fix availableOfficial, 3 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesGoogle Chrome 156.0.8078.73/.74 for Windows and Mac, 156.0.8078.73 for Linux (rolling out over the coming days and weeks). · since 28 Oct 2026
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerLures user to a malicious page
  2. 2Browser flawUnpatched bug is triggered
  3. 3Code runsAttacker runs code on the device
  4. 4Data at riskData can be read or changed
  5. ResultAttacker gains control of the browser session

What happened

Multiple unspecified vulnerabilities in Google Chrome and Microsoft Edge allow code execution, privilege escalation, security bypass, data disclosure or manipulation, spoofing, and denial of service. Chrome 156 fixes 52 bugs according to SecurityWeek.

Why it is dangerous: Anyone browsing with an unpatched browser, especially when visiting a malicious or compromised website, could be affected. The advisories describe a remote, anonymous attacker as able to execute code or crash the browser.

Are you affected?

You are affected if you use Google Chrome or Microsoft Edge on Windows, Mac or Linux with a version older than the fixed release.

Google Chrome and Microsoft Edge (Chromium-based); exact vulnerable version ranges not stated in the material.

What to do

  1. Update Google Chrome to version 156.0.8078.73 or later
  2. Update Microsoft Edge to the latest version offered by Microsoft
  3. Restart the browser after the update so the fix takes effect

Timeline

  1. 26 Oct 2026, 11:45 UTC
    Publicly disclosed
  2. 26 Oct 2026, 11:45 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  3. 26 Oct 2026, 11:46 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  4. 26 Oct 2026, 11:54 UTC
    Picked up by Zero Radar
  5. 28 Oct 2026, 12:40 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  6. 28 Oct 2026, 12:41 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  7. 28 Oct 2026, 12:45 UTC
    Fix: Updated browser versions released by Google and Microsoft; exact version numbers not stated in the source material
  8. 28 Oct 2026, 13:44 UTC
    Google Chrome reported on it · Google Chrome
  9. 28 Oct 2026, 15:31 UTC
    SecurityWeek reported on it · SecurityWeek
  10. 28 Oct 2026, 15:31 UTC
    Google Chrome reported on it · Google Chrome

Sources 6 reports, oldest first

Official vendor, government CERT or advisory database

Security press established security newsrooms

Technical details

ID
ZR-58640a39 · ZR-4c315706 · ZR-432cc94c · ZR-ed9f5078 · ZR-04dad7bd · ZR-4a19bd1e
Disclosed
26 Oct 2026, 11:45 UTC
On Zero Radar
26 Oct 2026, 11:54 UTC (9 min after disclosure)
Last change
28 Oct 2026, 15:31 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Google Chrome and Microsoft Edge: several serious security flaws · Zero Radar