CVE-2026-118318 in Chrome
Summary
by MITRE • 10/28/2026
Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified as an improper access control flaw within the V8 JavaScript engine, which powers Google Chrome prior to version 156.0.8078.73, represents a significant risk to user data confidentiality and system integrity. This specific security severity rating of High underscores the potential for remote attackers to exploit this weakness without requiring any form of authentication or physical access. The core issue lies in how V8 manages memory allocation and boundary checks during the execution of JavaScript code embedded within web pages. When a browser processes a crafted HTML page containing maliciously constructed scripts, the engine fails to properly enforce isolation boundaries between different security contexts or memory segments. This lapse allows an attacker who controls the content of the webpage to bypass intended restrictions on memory access that are normally enforced by the sandboxing mechanisms inherent in modern browsers.
From a technical perspective, this flaw is categorized under CWE-284, which describes Improper Access Control, and often manifests as part of CWE-125, Out-of-bounds Read vulnerabilities when it results in reading beyond allocated memory buffers. The V8 engine is responsible for parsing, compiling, and executing JavaScript code at high speeds to ensure smooth web performance. However, complex interactions between the Just-In-Time compiler and garbage collection routines can sometimes create race conditions or logic errors where pointer validation is skipped or incorrectly evaluated. In this instance, a specially crafted HTML page triggers these flawed paths by providing inputs that confuse the engine's internal state management regarding memory layout. Consequently, instead of throwing an exception or returning null as expected when accessing invalid addresses, V8 permits the read operation to proceed, exposing raw data from adjacent memory regions that should remain inaccessible to the script execution context.
The operational impact of this vulnerability is severe because it enables a remote code execution precursor scenario through information disclosure. By reading arbitrary memory locations, an attacker can potentially extract sensitive information such as session cookies, authentication tokens, cryptographic keys, or other user-specific data stored in browser memory. This capability effectively breaks the web sandbox model that protects users from malicious websites. If combined with other vulnerabilities or used to leak pointers for further exploitation techniques like heap spraying or arbitrary read primitives, this flaw can lead to full system compromise. Attackers typically deliver such exploits via phishing campaigns, compromised advertising networks, or drive-by downloads where a user is tricked into visiting the crafted webpage while using an affected version of Chrome.
To mitigate this risk, organizations and individual users must ensure that Google Chrome is updated to version 156.0.8078.73 or later immediately upon availability. This update contains patches for V8 that correct the access control logic and reinforce memory boundary checks during script execution. In environments where automatic updates are not feasible due to strict change management policies, IT administrators should prioritize patching systems running this browser version as a critical security measure. Additionally, deploying web filtering solutions or endpoint detection and response tools can help block access to known malicious domains hosting such exploits until the underlying software is remediated. Users should also remain vigilant against unsolicited links from untrusted sources, although reliance on user caution alone is insufficient given the sophistication of modern exploit kits that automate delivery of these crafted pages.