CVE-2026-118344 in Chrome
Summary
by MITRE • 10/28/2026
Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified as a use-after-free condition within the Layout component of Google Chrome prior to version 156.0.8078.73 represents a critical memory corruption flaw that undermines the browser's sandboxing mechanisms. This specific defect arises when an object is deallocated from memory but continues to be referenced by other parts of the application, specifically during layout calculations for rendered web content. In modern browsers like Chrome, the renderer process operates within a strict security sandbox designed to limit the privileges of code executing untrusted web pages. By exploiting this use-after-free condition, a remote attacker can manipulate the state of freed memory to achieve arbitrary code execution within that restricted environment. The severity is classified as critical because successful exploitation allows an adversary to bypass these isolation boundaries, effectively gaining control over the renderer process and potentially escalating privileges to compromise the underlying host system if further vulnerabilities are chained or sandbox escape techniques are employed.
From a technical perspective, use-after-free errors occur when a pointer continues to be used after the memory it points to has been freed. In the context of Chromium's layout engine, this likely involves complex interactions between JavaScript execution and DOM manipulation where timing conditions allow an attacker to free a layout object while retaining a reference to it through another data structure or event handler. When the browser subsequently attempts to access or modify this stale pointer, it may read from or write to arbitrary memory locations controlled by the attacker. This can lead to heap corruption, which is often leveraged to overwrite function pointers or virtual table entries with malicious shellcode addresses. The presence of such a flaw in the layout subsystem highlights the complexity of managing dynamic web content and the difficulty of ensuring safe memory management across all code paths involved in rendering HTML and CSS structures.
The operational impact of this vulnerability is severe, as it enables remote code execution through simple interaction with a crafted webpage. An attacker does not need physical access or prior authentication; they merely need to trick a user into visiting a malicious site containing the exploit payload. Once loaded, the script can trigger the specific sequence that leads to the use-after-free condition and subsequent memory corruption. This aligns directly with ATT&CK technique T1059 Command and Scripting Interpreter, as well as techniques related to execution within sandboxed environments such as T1610 Sandbox Escape if the attacker leverages this foothold to break out of the renderer process. The ability to execute arbitrary code inside the sandbox significantly increases the attack surface for subsequent stages of an intrusion campaign, including data exfiltration, persistence establishment, and lateral movement within a network environment where compromised endpoints serve as entry points.
Mitigation strategies primarily involve updating Google Chrome to version 156.0.8078.73 or later, which contains the necessary patches to correct the memory management logic in the layout component. Organizations should enforce automated update policies for all client machines to ensure timely application of security fixes. Additionally, deploying browser isolation solutions can provide an additional layer of defense by rendering web content in a remote virtual environment, thereby preventing local exploitation even if vulnerabilities exist within the browser binary. Security teams should also monitor for indicators of compromise associated with known exploit kits that target this specific vulnerability class and restrict execution policies to prevent unauthorized scripts from running on critical systems. Regular auditing of third-party plugins and extensions is also recommended as they may introduce similar memory safety issues or interact unpredictably with patched components.