Live › vulnerability › CVE-2026-118353
Go to dashboardA use-after-free bug in the Paint component of Google Chrome before 156.0.8078.73 lets a remote attacker run arbitrary code inside the browser sandbox when the victim opens a crafted HTML page. The sources rate it High in Chromium's severity scale and do not say whether a sandbox escape exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 23:29 UTC. All times on this page are UTC.
Any device running Google Chrome older than 156.0.8078.73 is exposed, and the risk comes from browsing to a malicious or compromised page. Managed fleets and shared workstations are the most important to check, since a single visit is enough. Systems that run Chrome only in a locked-down kiosk with no untrusted browsing can wait for the normal update cycle.
No product ranges from the sources yet.
google-chrome --version on Linux, or check the Chrome version in the installed app on macOS or Windows156.0.8078.73156.0.8078.73 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-118353")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.