Zero Radar
← feed
CriticalVulnerabilityCVE-2026-118346updated 31 Oct 2026, 18:00 UTC

Google Chrome: memory bug lets crafted web pages run code

A flaw in how Chrome draws web pages can be abused by a malicious website. Visiting that site could let an attacker run code on your computer inside the browser's protective sandbox.

Fix availableOfficial, 3 sources
SeverityCriticalCVSS 8.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesGoogle Chrome 156.0.8078.73 or later; ChromeOS 16836.30.0 (Browser 156.0.8078.77) or later. · since 28 Oct 2026
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker builds pageCrafted HTML page exploits compositing memory bug
  2. 2Victim opens pageUser visits the malicious website
  3. 3Use-after-free triggeredFreed memory in Compositing is reused unsafely
  4. 4Code runs in sandboxAttacker may execute arbitrary code inside sandbox
  5. ResultAttacker runs code inside the browser sandbox

What happened

A use-after-free (memory reuse) bug in the Compositing component of Google Chrome before 156.0.8078.73 can be triggered by a crafted HTML page to potentially execute arbitrary code inside the sandbox.

Why it is dangerous: Anyone who opens a malicious or compromised web page in an affected browser may have their browser abused, and Chromium-based browsers such as Microsoft Edge that include this fix are in the same position. Google rates it High, while the NVD record lists CVSS 8.8.

Are you affected?

You are affected if you run Google Chrome earlier than 156.0.8078.73, or ChromeOS or ChromeOS Flex before 16836.30.0 (Browser 156.0.8078.77), or a Chromium-based browser such as Microsoft Edge that has not yet taken this Chromium fix.

Google Chrome prior to 156.0.8078.73; ChromeOS / ChromeOS Flex before 16836.30.0 (Browser 156.0.8078.77); Microsoft Edge (Chromium-based) builds that include the affected Chromium code (exact Edge versions unknown).

What to do

  1. Update Google Chrome to 156.0.8078.73 or later (or ChromeOS to 16836.30.0 / Browser 156.0.8078.77).
  2. Update Microsoft Edge and other Chromium-based browsers to versions that include the Chromium fix.
  3. Restart the browser after updating so the fix takes effect.

Timeline

  1. 27 Oct 2026, 23:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 19:45 UTC
    Reported by Google Chrome · Google Chrome
  3. 28 Oct 2026, 20:32 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 04:19 UTC
    NVD reported on it · NVD
  5. 31 Oct 2026, 18:00 UTC
    Microsoft MSRC reported on it · Microsoft MSRC

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118346
CVSS
8.8 / 10
Disclosed
27 Oct 2026, 23:17 UTC
On Zero Radar
28 Oct 2026, 20:32 UTC (21 h after disclosure)
Last change
31 Oct 2026, 18:00 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Google Chrome: memory bug lets crafted web pages run code · Zero Radar