CVE-2026-118357
published 2026-10-27CVE-2026-118357: Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a…
PriorityP353high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.28%
20.8th percentile
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 156.0.8078.73 | 156.0.8078.73 | |
| chrome | >= 156.0.8078.73 < 156.0.8078.73 | 156.0.8078.73 | |
| chrome_desktop | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
ghsa_unreviewed·2026-10-28
CVE-2026-118357 CWE-416 Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
VulDB
Google Chrome up to 156.0.8078.47 FileSystem use after free (EUVD-2026-111427)
vuldb·2026-10-28
CVE-2026-118357 [CRITICAL] Google Chrome up to 156.0.8078.47 FileSystem use after free (EUVD-2026-111427)
A vulnerability labeled as critical has been found in Google Chrome. This issue affects some unknown processing of the component FileSystem. Such manipulation leads to use after free.
This vulnerability is referenced as CVE-2026-118357. It is possible to launch the attack remotely. No exploit is available.
The affected component should be upgraded.
Red Hat
chromium-browser: Use after free in FileSystem
vendor_redhat·2026-10-27·CVSS 8.8
CVE-2026-118357 [HIGH] CWE-416 chromium-browser: Use after free in FileSystem
chromium-browser: Use after free in FileSystem
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
An use after free flaw was found in the FileSystem component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/562191732
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Chrome
Stable Channel Update for Desktop: CVE-2026-118344
vendor_chrome·2026-10-27
CVE-2026-118344 [CRITICAL] Stable Channel Update for Desktop: CVE-2026-118344
Stable Channel Update for Desktop
CVE-2026-118344: Use after free in Layout. Reported by Xinyang Ge on 2026-10-17 [N/A][ 562191732 ] High CVE-2026-118357: Use after free in FileSystem
Reported by Xinyang Ge on 2026-09-16 [TBD][ 565133743 ] High CVE-2026-118318: Improper access control in V8
Severity: critical
No detection rules found.
No public exploits indexed.
2026-10-27
Published