Vulnerability record

CVE-2026-118307

HighNo known exploitation

Patch status

Official fix available since Oct 27, 2026

Apply the vendor's update to every affected system. Check the fixed-in versions below where known.

Basis: Google Chrome Releases vendor advisory

Description

Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Intelligence timeline

Developments from the last 30 days, newest first.

CVSS scoredUpdateOct 28, 2026
CVE-2026-118307 scored CVSS 8.8
Basis: NIST National Vulnerability Database

Coverage

CriticalPatch

Beta Channel Update for ChromeOS / ChromeOS Flex

Patch

Apply the vendor's security update for Chrome.

Google Chrome Releases · 2 sources

Vendor advisoryGoogle Chrome Releases
Vendor advisoryGoogle Chrome Releases

yesterdayHomeSMBEnterprise

References

chromereleases.googleblog.com https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html
issues.chromium.org https://issues.chromium.org/issues/570675085