CVE-2026-118347 in Chrome
Summary
by MITRE • 10/28/2026
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified as a use-after-free condition within the FileSystem component of Google Chrome prior to version 156.0.8078.73 represents a critical memory management error that allows for arbitrary code execution under specific conditions. This flaw stems from improper handling of object lifecycles, where a pointer to an already freed memory block is accessed or dereferenced by the application logic. In the context of web browsers, such vulnerabilities are particularly dangerous because they can be triggered through standard web technologies like JavaScript and HTML, enabling remote attackers to exploit the issue without requiring any user interaction beyond visiting a maliciously crafted webpage. The severity rating of High from Chromium reflects the potential for significant compromise of the browser's security model when this flaw is leveraged effectively.
From a technical perspective, use-after-free vulnerabilities occur when software continues to use memory after it has been freed or deallocated by the system. This typically happens due to race conditions, incorrect reference counting, or failure to nullify pointers after deletion. When an attacker crafts an HTML page that triggers this specific sequence within the FileSystem API, they can manipulate the contents of the freed memory region before it is reallocated for a different purpose. By carefully controlling what data is written into that memory space during its reuse phase, the attacker can achieve control over critical program flow indicators such as return addresses or function pointers. This manipulation allows the execution of arbitrary machine code within the context of the browser process, effectively bypassing intended isolation boundaries and leading to full compromise of the affected system if other mitigations fail.
The operational impact of this vulnerability is severe due to its potential for remote code execution via a crafted HTML page. An attacker can distribute malicious links through phishing campaigns, compromised websites, or drive-by download scenarios. When a victim visits such a site while using an unpatched version of Chrome, the browser's FileSystem component processes the input in a way that triggers the memory corruption. Although modern browsers employ sandboxing techniques to limit the damage caused by exploits, successful exploitation of this vulnerability could allow code execution within the sandbox environment itself. Depending on the specific implementation details and the effectiveness of other security layers like DEP or ASLR, an attacker might be able to escape the browser's sandbox entirely, gaining access to sensitive user data, installing persistent malware, or using the compromised machine as a pivot point for further network attacks.
This vulnerability aligns with CWE-416, which defines use-after-free errors as a class of software weaknesses resulting from improper memory management practices that lead to accessing freed memory. In terms of offensive security frameworks, this exploit scenario maps closely to MITRE ATT&CK technique T1203, specifically the subtechnique related to exploitation for browser compromise or client-side attacks such as drive-by downloads and web-based phishing. The attack vector is classified as remote with low complexity regarding user interaction since it relies on a crafted webpage rather than complex social engineering beyond initial access. Defense in depth strategies are essential here; while patching Chrome immediately resolves the root cause, organizations should also enforce strict content security policies to restrict inline scripts and untrusted sources, utilize browser hardening configurations, and ensure that endpoint detection and response solutions are active to monitor for anomalous behavior indicative of exploitation attempts. Regular updates to all software components remain the most effective mitigation against such memory corruption vulnerabilities.