A critical Chrome vulnerability published by the National Vulnerability Database affects Google’s browser on workstations. A fix is already available: Chrome needs to be updated to version 156.0.8078.73 or later, on every device.
What is it?
A flaw in the Google Chrome browser could let a simple booby-trapped webpage trigger instructions it was never meant to run on the computer viewing it.
The vulnerability is tracked as CVE-2026-118305. According to the National Vulnerability Database record published October 27, 2026, it affects Google Chrome versions before 156.0.8078.73. A webpage built for this purpose could allow a remote attacker to execute code beyond the browser’s internal protections. Those protections, what IT professionals call the sandbox, keep anything coming from the Internet locked in a sealed room, away from the rest of the computer. Here, that wall can give way. It’s a bit like a garage door left slightly open: nothing looks out of place from the street, yet the path into the house is no longer blocked. The same record lists eleven other Chrome vulnerabilities at the same severity level, published during the same period.
Why is it serious?
The NVD record assigns a score of 9.6 out of 10, near the top of the scale, and reports no known exploitation to date; a fix, however, is already available.
That 9.6 out of 10 is a CVSS 3.1 score: an international scale that rates the severity of a vulnerability from 0 to 10, assigned here by the reporting organization (the CNA). The same record mentions no exploitation and no public proof-of-concept. That reflects the information available as of this writing, nothing more: the absence of a report doesn’t prove no attack has occurred.
In business terms, a workstation compromised through the browser becomes a possible entry point to whatever its user can reach: an email inbox, client files, accounting records. The actual scope depends on the workstation’s permissions and the safeguards in place. A compromise doesn’t automatically grant access to everything, and certainly not to bank accounts. No protection is absolute, but installing the fix without delay significantly reduces the exposure.
Who is affected?
Workstations still running a version of Google Chrome older than 156.0.8078.73.
Product: Chrome. Vendor: Google. Affected versions: earlier than 156.0.8078.73. Fixed version: 156.0.8078.73. The NVD record doesn’t specify which operating systems are affected, and the sources reviewed say nothing about other browsers. Chrome is used across every sector, from auto shops to medical clinics, so no trade is exempt; but the workstations at risk are only those still running a version older than the fix.
How do I check my business?
It comes down to confirming Chrome’s version number on every workstation, then making sure the fix installs without anyone having to do it by hand.
- Have someone check Chrome’s version number on every workstation, through the Help menu, then About Google Chrome (management or an internal lead).
- Confirm the installed version is 156.0.8078.73 or later and that the browser was restarted after the update (IT provider).
- Get confirmation that automatic patching is active across the entire fleet, including remote workers (IT provider, or the vendor of your device management software, the tool that tracks the organization’s devices and installs patches on them remotely).
What This Critical Chrome Vulnerability Means for a Canadian Business
For a Quebec SME, the question is concrete: how many workstations are still running an older version, and who’s responsible for fixing them. The Canadian Centre for Cyber Security’s baseline cyber security controls list timely patching among the first measures expected of a small organization.
Scenario
Fictional example: a neighborhood dental clinic hasn’t restarted its browsers in weeks.
On a Monday morning, the receptionist is looking up a supplier and opens what looks like an ordinary page. The workstation slows down, then the scheduling software refuses to open. The IT provider isolates the machine and resets the passwords. The day’s appointments are pushed back, patients are called one by one, and management has to check whether any health information was accessed. Nothing dramatic, just a disorganized week over a fix that got put off.
What to do now
- Ask today for the list of workstations where Chrome is installed, including remote workers.
- Install version 156.0.8078.73 or later, then restart every browser so the fix takes effect.
- Turn on automatic browser updates, so this no longer depends on everyone remembering.
- Agree with your IT provider on a written rule for applying critical patches, and log the check done this week.
FAQ
Should we stop using Chrome?
No. The problem isn’t the browser as a product, but an outdated version, and the vendor has already released a fixed one. Switching browsers in a panic would create other risks: poorly vetted extensions (the small add-ons installed to give the browser extra features), passwords copied out by hand, confused employees. The right move is to patch, then automate that patching for next time.
No attack has been reported, can we wait?
We don’t recommend it. The NVD record reports none, but the vulnerability is now public, and so is the fix. Waiting means leaving open a door whose existence is now known.
What if a workstation was already compromised?
Have your IT provider examine it before putting it back into service. In Quebec, Law 25 requires keeping a register of confidentiality incidents and, when there’s a risk of serious harm, notifying the Commission d’accès à l’information (Québec’s access-to-information and privacy regulator) and the people affected. Be wary of any claim promising total protection: no provider can guarantee zero risk.
Sources
- CVE-2026-118305 record, National Vulnerability Database · NIST, October 27, 2026
- Canadian Centre for Cyber Security: baseline cyber security controls for small and medium organizations · baseline checklist
- Commission d’accès à l’information du Québec · obligations, incident register and notification
Source: NVD (NIST) · https://nvd.nist.gov/vuln/detail/CVE-2026-118305
Article prepared by RISS Canada’s monitoring team from the public sources cited above, with the assistance of artificial intelligence tools, then reviewed according to our editorial policy.
