Live › vulnerability › CVE-2026-118330
Go to dashboardA use-after-free bug in the Browser component of Google Chrome on Windows lets a remote attacker run arbitrary code inside the browser sandbox when a user opens a crafted HTML page. Chromium rates it High severity.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 23:29 UTC. All times on this page are UTC.
Any Windows machine running Google Chrome older than 156.0.8078.73 is exposed. Exposure needs a user to visit a page the attacker controls, so managed fleets with auto-update enabled are usually patched quickly. Teams on Chromium-based builds that lag behind upstream should check their own builds.
No product ranges from the sources yet.
chrome://settings/help and read the installed versionchrome --version on the machine, where the browser is installed156.0.8078.73 or later, via chrome://settings/help or your managed update toolEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-118330")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.