CVE-2026-118317 in Chrome
Summary
by MITRE • 10/28/2026
Memory corruption in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability described involves a critical memory corruption flaw within the Hypertext Markup Language processing engine of Google Chrome, specifically affecting versions prior to 156.0.8078.73. This defect resides in the core rendering and parsing components that handle HTML content, which is fundamental to how browsers interpret web pages. The severity of this issue is classified as High by the Chromium security team, indicating a significant risk to user safety due to its potential for remote code execution. Such vulnerabilities typically arise from improper handling of memory allocation or deallocation during the processing of complex or malformed HTML structures, leading to states where the browser's internal data becomes inconsistent or corrupted in ways that can be exploited by malicious actors.
The technical nature of this flaw allows a remote attacker to trigger arbitrary code execution within the Chrome sandbox environment through the delivery of a specially crafted HTML page. The attack vector relies on social engineering or drive-by download techniques, where an unsuspecting user visits a compromised website containing the exploit payload. When the browser parses the malicious HTML, it encounters specific conditions that cause memory corruption, such as buffer overflows, use-after-free errors, or heap sprays. These low-level memory manipulation techniques enable the attacker to overwrite critical pointers or control flow data within the process memory space. Despite Chrome's robust sandboxing architecture designed to isolate web content from the host operating system, sophisticated exploits can sometimes bypass these restrictions by chaining multiple vulnerabilities or exploiting weaknesses in the inter-process communication mechanisms, ultimately achieving code execution with the privileges of the browser process.
The operational impact of this vulnerability is severe, as successful exploitation grants an attacker full control over the affected application instance. This level of access allows for a wide range of malicious activities, including but not limited to stealing sensitive user data such as cookies, passwords, and browsing history; installing persistent malware or backdoors on the victim's system; conducting further phishing attacks using trusted credentials; or pivoting into internal network resources if the browser is used in an enterprise environment with specific trust configurations. The ability to execute arbitrary code means that the confidentiality, integrity, and availability of user data are compromised. Furthermore, because this vulnerability exists prior to version 156.0.8078.73, any system running older versions remains exposed until a patch is applied or an update is performed.
To mitigate the risks associated with this memory corruption flaw, immediate action is required to ensure that all instances of Google Chrome are updated to version 156.0.8078.73 or later. This release contains the necessary code fixes and security patches that address the underlying issues in the HTML parsing engine. Organizations should enforce automated update policies for browsers across their endpoints to prevent exposure to such vulnerabilities. Additionally, users can employ browser hardening techniques, such as disabling JavaScript on untrusted sites using extensions like NoScript or configuring strict content security policies if they are developers testing web applications. While sandboxing provides a layer of defense, it is not infallible against high-severity exploits that target the renderer process directly. Therefore, keeping software up to date remains the most effective primary defense strategy against remote code execution vulnerabilities in modern browsers.
From a classification perspective, this vulnerability aligns with Common Weakness Enumeration categories related to memory safety errors, such as CWE-120 Buffer Copy without Checking Size of Input or CWE-416 Use After Free, depending on the specific mechanism exploited within the HTML parser. In terms of adversary tactics and techniques, this exploit maps directly to MITRE ATT&CK technique T1203 Exploitation for Client Execution, where attackers leverage software vulnerabilities in client applications like web browsers to execute malicious code. Understanding these mappings helps security teams prioritize patching efforts based on both the technical severity and the tactical relevance of the vulnerability within broader cyber attack lifecycles.