How to Fix CVE-2026-120931 in Google Chrome

The two-minute check

1. Open Google Chrome on each computer, phone, or tablet your business uses.
2. Type chrome://settings/help into the address bar and press enter.
3. Look at the version number Chrome shows you on that screen.
4. Note which device it's running on: Windows, macOS, Android, or iPhone OS.
5. Check whether the page says Chrome is up to date or needs an update.

When you can stop reading

If your business does not use Google Chrome on any computer or phone, this update does not apply to you. If you use a different browser entirely, you can close this tab. Everyone else should keep reading, because the affected setups cover Chrome on Windows, macOS, Android, and iPhone OS.

What the official record says

The National Vulnerability Database (NVD) rates this flaw CVSS 9.6, Critical, using the Common Vulnerability Scoring System (CVSS) version 3.1 (NVD). The scoring details matter more than the number alone. An attacker only needs network access and no account or password on your system. They do need you, or someone on your team, to interact with a crafted web page, such as opening it. Once that happens, the bug can let code run outside the browser's normal protective sandbox, affecting confidentiality, integrity, and availability of the device.

The Exploit Prediction Scoring System (EPSS) puts the chance of exploitation in the next 30 days at 0.42%, in the 36.5th percentile of all scored flaws (FIRST.org). EPSS is a forecast of attacker activity, not a measure of how damaging the flaw would be if used. This flaw is not on the CISA Known Exploited Vulnerabilities (KEV) catalog, and the record shows no confirmed exploitation so far. That can change, which is exactly why vendors patch ahead of time.

The same update also fixes a long list of other issues Google found internally, including CVE-2026-121257, CVE-2026-121250, CVE-2026-121249, CVE-2026-121247, and CVE-2026-121246, among 156 others. You install one update and all of them close together.

What that means for a business like yours

Picture an employee opening a web page, a link in an email, or an ad that loads a crafted page. If Chrome is unpatched, that single action could let an attacker run code on that device. Because the record lists Windows, macOS, Android, and iPhone OS, this touches nearly any device your staff browses the web on. It is a real risk worth fixing promptly, not a reason to panic.

If someone else manages your IT

Send this to your provider, word for word:

"Please confirm Google Chrome is updated on every company computer and phone. This closes CVE-2026-120931 and a batch of related flaws fixed in the same release. Please tell me once it's confirmed done."

If you don't already have a provider doing this kind of patching for you, our managed IT services team handles exactly this.

If you manage it yourself

1. Open Google Chrome on the device.
2. Click the three dots in the top right corner.
3. Select Help, then About Google Chrome.
4. Let Chrome check for updates on its own.
5. Click Relaunch when the button appears to finish installing it.
6. Repeat this on every work computer and phone, including anyone working remotely.

The official release notes for this fix are here for reference: the October update and the November update that followed it.

There is no confirmed exploitation right now, and the forecast for attacker activity in the next 30 days is low. That gives you a reasonable window, not an emergency. A sensible target is to get every device updated within the next week as part of normal patching. If this flaw later appears on the CISA Known Exploited Vulnerabilities catalog, that changes the urgency and you should move immediately.

Don't just trust the progress bar. Go back to chrome://settings/help on each device after you update it. The page should say Chrome is up to date, with no pending restart needed. Confirm the version shown is 156.0.8078.47 or later on Android devices, or 157.0.8103.38 or later on other platforms, since that covers this flaw and the sibling fixes together.

If a device can't be updated immediately, these steps reduce risk without fully closing it.

• Avoid opening unknown links or attachments in Chrome on that device until it's patched. This limits the chance a crafted page ever gets opened, but does not remove the flaw.
• Turn on automatic updates in Chrome so the fix installs the moment it's available. This buys you consistency going forward, not protection today.
• Restrict who can install Chrome extensions on company devices. Some of the related fixes in this update involve extensions as an attack path.
• Make sure endpoint detection and response (EDR) tools are active on the device. EDR can catch suspicious behavior after the fact, but it is not a substitute for patching.

None of these replace the update. They only reduce the odds something goes wrong while you get it installed. Our cybersecurity services team can help put these controls in place properly.

Do I have to do anything if we only use Chrome at home?

Yes, the same update applies to personal devices running Chrome. The fix and the steps to apply it are identical to a work computer.

Will this update break anything we use?

The record doesn't list any compatibility issues. Chrome updates like this are routine engineering work, and most businesses see no disruption at all.

Does this only affect Android phones, or our Windows computers too?

Both. The record lists Chrome on Windows, macOS, Android, and iPhone OS, so any device running Chrome should be updated.

How do we know if we were already attacked through this?

The record shows no confirmed exploitation of this flaw. There's no indicator built into this advisory to check for past compromise, so the right move is to patch now and watch for unusual device behavior going forward.

What if we use Chrome on an iPhone?

iPhone OS is one of the platforms named in the record, so the same update applies. Update Chrome through the same About Google Chrome screen described above.

If you'd rather have someone confirm every device in your business is covered, get a free IT assessment or contact LayerLogix and we'll take it from here.