Multiple Critical Chrome Vulnerabilities Could Enable Arbitrary Code Execution

What happened

CIS advisory 2026‑122 (27 Oct 2026) reports 22 newly disclosed CVEs affecting Google Chrome versions < 156.0.8078.73/74 for Windows/macOS and < 156.0.8078.73 for Linux. The most severe flaws are memory‑corruption and use‑after‑free bugs that can be triggered by a drive‑by compromise, granting an attacker the ability to execute arbitrary code as the logged‑on user. With administrative privileges, the attacker could install software, alter or delete data, or create new privileged accounts. No active exploitation has been observed, but the advisory rates the risk as Medium for government and business entities.

Why it matters for trust and compliance

• The flaws highlight the need for strong vulnerability‑management controls—timely patching, accurate software inventories, and documented remediation evidence—to demonstrate trust and control assurance across multiple frameworks.
• Map patch‑management processes to control objectives and collect version‑level evidence for audit readiness.
• Leverage continuous monitoring to detect unpatched browsers and generate defensible remediation reports.

Who is affected

Recommended actions

1. Upgrade Chrome to version 156.0.8078.73 or later on all endpoints.
2. Enable automatic browser updates to ensure future patches are applied promptly.
3. Maintain an up‑to‑date inventory of browser versions and map patch status to audit evidence.
4. Deploy endpoint detection rules to flag suspicious drive‑by download activity.