CVE-2026-118306 is a Critical use-after-free in the FileSystem component of Google Chrome. According to the NVD record, a remote attacker could use a crafted HTML page to execute arbitrary code outside the browser sandbox. Chrome fixed it in 156.0.8078.73 on 27 October 2026, and Chrome 157 (157.0.8103.38) followed on 3 November. Update desktop Chrome and restart it.
- Fix releasedYesChrome 156.0.8078.73/.74 on Windows and Mac, .73 on Linux, 27 Oct 202627 Oct 2026
- Chromium severityYesCritical27 Oct 2026
- Exploitation per CISA SSVC entry in NVDNot seenCISA coordinator entry: exploitation none, automatable no, technical impact total28 Oct 2026
- CISA KEV listingNot seenNot in the KEV catalog release of 4 Nov 20264 Nov 2026
What Do the Chrome Release Notes and NVD Say?
The 27 October stable update contains 52 security fixes. Four are rated Critical: CVE-2026-118306 (FileSystem), CVE-2026-118331 (FileAPI), CVE-2026-118344 (Layout) and CVE-2026-118348 (Skia). The release notes credit Xinyang Ge of Anthropic, assisted by Claude, for CVE-2026-118306, reported on 7 October 2026.
NVD lists a CVSS 3.1 base score of 9.6 from a secondary source (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). It shows no CVSS 4.0 score. The record’s weakness is CWE-416, use after free. Chrome’s release notes also list two High use-after-free bugs in FileSystem, CVE-2026-118357 and CVE-2026-118347.
Why Does a Use-After-Free Here Matter?
A use-after-free means the browser keeps using memory after it has been released, so an attacker who controls what is placed there can steer execution. The record’s wording, code execution outside the sandbox, is the dangerous part: the sandbox is the barrier that normally contains a hijacked web page.
The vector has User Interaction set to Required, so the victim must open the crafted page. That fits a drive-by pattern, which we map to Drive-by Compromise. The record does not give the root cause or the exact API path, so we cannot say more about how the page reaches the bug.
How Do You Check and Close the Gap?
- Open chrome://version on a sample of machines and confirm 156.0.8078.73 or later. Prefer 157.0.8103.38, the current stable build.
- Check that browsers have actually restarted. A downloaded update does not protect the running process until Chrome relaunches.
- For managed fleets, pull the Chrome version from your endpoint inventory or Chrome Browser Cloud Management, and set a relaunch notification policy so users cannot postpone the restart for long.
- List other Chromium-based browsers and embedded Chromium apps. The record covers Google Chrome only, so check each vendor’s own release notes for a matching fix.
- In endpoint detection, review unusual child processes spawned by the browser and files it wrote just before an alert. Keep that hunt running through the next patch cycle.
Steps 4 and 5 are our advice. Our patch management glossary entry covers how to order such browser updates across a fleet.
What Do the Records Still Leave Open?
NVD shows an SSVC entry from the CISA coordinator that reads exploitation none, last modified 3 November 2026. The entry carries a 28 October 2026 timestamp, so read it as a dated snapshot, not as a statement about today. The CISA KEV catalog release of 4 November 2026 does not list the CVE.