Google Chrome: Improper input validation in Actor component
Summary
Google Chrome versions before 156.0.8078.47 contain an improper input validation flaw in the component named "Actor". A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack requires that a user opens the malicious page, for example through a phishing link or a compromised website. NVD rates the issue with CVSS 3.1 8.8 (High), while Google rates it Medium.
Affected
- Google Chrome desktop prior to 156.0.8078.47 (Windows, macOS, Linux)
- Chromium-based browsers that have not received the same fix, for example Microsoft Edge prior to 156.0.4314.42 (per HKCERT bulletin)
Fixed in
- Google Chrome 156.0.8078.47 or later (Windows, macOS: 156.0.8078.48; Linux: 156.0.8078.47), released 20 October 2026
- Microsoft Edge 156.0.4314.42 or later
- Newer Chrome 156 builds are reported by third-party sources; verify against Google's release notes
- Debian Chromium updates: DSA 6577-1 and DLA 4853-1; Ubuntu chromium-browser package: not affected (installs Chromium snap, snap patch status unverified)
Workaround
- No workaround documented for the Actor component; apply the update
- Ensure managed endpoints do not block browser updates
Exploitation
- No known exploitation in the wild; not listed in CISA KEV according to one aggregator (KEV catalogue not directly checked)
- No public proof of concept found
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
Our recommendation
- Update Google Chrome to 156.0.8078.47 or later on all Windows, macOS and Linux devices
- Update Microsoft Edge to 156.0.4314.42 or later
- Check Linux Chromium packages and Chromium-based applications for vendor updates
- Force a browser restart after the update so the new version is active
- Verify update status across managed devices and monitor for unpatched browsers
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker entry issues.chromium.org
- NVD record via Vulners vulners.com
- HKCERT security bulletin (Microsoft Edge) www.hkcert.org
- Ubuntu security notice ubuntu.com
- Vulners CVE list entry vulners.com
- Strix CVE entry www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 13:31.
Original description (NVD)
Improper input validation in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.