NewsCompaniesFlawsGuides
Get the app
CriticalFixedUpdated

CVE-2026-118306

A memory-handling flaw in Chrome's FileSystem component could let a malicious web page run attacker-controlled code outside the browser's protective sandbox.

What to do

On a computer, open Chrome's menu → Help → About Google Chrome, install the latest update and relaunch; the first fixed desktop builds are 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux. Update Chrome on Android through Google Play to 156.0.8078.73 or later. On a Chromebook, install ChromeOS 16836.30.0 or later; ask IT to update managed devices.

Affects
Google Chrome on Windows, Mac, Linux and Android; ChromeOS and ChromeOS Flex for CVE-2026-118331
Severity
Critical
Fixed in
Google Chrome 156.0.8078.73/.74 for Windows and Mac
Google Chrome 156.0.8078.73 for Linux
Google Chrome 156.0.8078.73 for Android
ChromeOS and ChromeOS Flex 16836.30.0, browser 156.0.8078.77: explicitly fixes CVE-2026-118331
Being used in attacks
Not known to be
Made public
27 Oct 2026

Part of: Chrome fixes four critical flaws, including CVE-2026-118306 sandbox escape

Google fixed four critical flaws in Chrome's file handling, graphics and page layout components on 27 October. Google's CVE descriptions say malicious web pages could use CVE-2026-118306 to run code outside the browser's protective sandbox; the other three allow code execution inside it. Chrome versions before 156.0.8078.73 are affected. Desktop fixes arrived in 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux, with Android fixes in 156.0.8078.73. Newer desktop builds followed on 29 October. ChromeOS and ChromeOS Flex 16836.30.0 explicitly fix CVE-2026-118331; their notice does not establish whether the other three affect ChromeOS. These are released fixes, although Google announced staged rollouts. Attack use is not confirmed: CIS reported no known exploitation on 27 October, and Avertium's 2 November report also said exploitation was unconfirmed.

The whole incident, its timeline and sources

Fixed in the same update

Sources

  1. Stable Channel Update for DesktopGoogle · 27 Oct 2026
  2. Chrome for Android UpdateGoogle · 27 Oct 2026
  3. Stable Channel Update for ChromeOS / ChromeOS FlexGoogle · 28 Oct 2026
  4. Chrome Releases: 29 October desktop updateGoogle · 29 Oct 2026
  5. CVE-2026-118306: Chrome CNA recordGoogle Chrome via CVE.org · 27 Oct 2026
  6. CVE-2026-118331: Chrome CNA recordGoogle Chrome via CVE.org · 27 Oct 2026
  7. CVE-2026-118348: Chrome CNA recordGoogle Chrome via CVE.org · 27 Oct 2026
  8. CVE-2026-118344: Chrome CNA recordGoogle Chrome via CVE.org · 27 Oct 2026
Also: CVE-2026-118306 at CVE.org · NVD · Every flaw being used in attacks · Everything live