The Indian Computer Emergency Response Team (CERT‑In) has issued a critical‑severity advisory for Google Chrome on desktop, saying several security flaws could let attackers execute code, access private data or evade browser safeguards. CERT‑In published the advisory as vulnerability note CIVN‑2026‑0524 on 26 October 2026.
Who is affected and which versions to update
CERT‑In says the issues affect Chrome builds released before specific patched versions. The agency lists the affected versions exactly as follows:
- Windows and macOS: versions earlier than 156.0.8078.47/.48
- Linux: versions earlier than 156.0.8078.47
Organisations and individual users running these versions are urged to apply the patches described in Google’s security updates. CERT‑In categorised the collection of flaws as critical because they could permit remote attackers to run arbitrary code, obtain sensitive information or bypass browser protections.
What kinds of bugs were reported
The advisory says the vulnerabilities arise from multiple types of implementation errors, including:
- use‑after‑free and memory corruption
- improper input validation and out‑of‑bounds reads/writes
- type confusion, range errors and missing authorisation checks
- information leaks and improper access control
CERT‑In notes that a typical exploitation vector would involve an attacker convincing a user to open a crafted web request; successful exploitation could result in a denial‑of‑service or more serious impacts such as unauthorised data access and full system compromise.
How to check and install the patch
CERT‑In directs users to Google’s security updates for technical details and remediation steps. For most users the quickest way to update Chrome is to use the browser’s built‑in update function:
- Open Google Chrome
- Click the three‑dot menu at the top‑right
- Navigate to Help > About Google Chrome — Chrome will check for updates and install them if available
Organisations should follow their normal patch management procedures and consult Google’s advisories for enterprise deployment guidance and any available mitigation. CERT‑In’s note explicitly recommends referring to Google’s published security bulletins for affected components and fixed versions.
| Platform | Update target |
|---|---|
| Windows | 156.0.8078.47/.48 or later |
| macOS | 156.0.8078.47/.48 or later |
| Linux | 156.0.8078.47 or later |
CERT‑In’s advisory underlines the need for rapid remediation because the flaws could be weaponised remotely. Users who cannot update immediately should limit exposure by avoiding risky websites and untrusted links until their browsers are patched.
The advisory and the exact technical descriptions are recorded in CERT‑In’s vulnerability note CIVN‑2026‑0524, dated 26 October 2026; Google’s security release contains the vendor’s fixes and further guidance for administrators and end users.
