CVE-2026-118350 in Chrome
Summary
by MITRE • 10/28/2026
Memory corruption in Payments in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified as a use-after-free flaw within Turbolev in Google Chrome prior to version 156.0.8078.73 represents a critical memory management error that compromises the integrity of the browser's execution environment. This specific class of vulnerabilities occurs when an application continues to use a pointer after it has been freed, leading to undefined behavior that can be exploited by malicious actors. In this instance, the flaw resides within Turbolev, which is likely related to internal rendering or layout engines used in Chromium-based browsers. The presence of such a defect indicates a failure in proper memory lifecycle management, where resources are deallocated while still being referenced by active processes or data structures. This creates a window of opportunity for attackers to manipulate heap contents and achieve arbitrary code execution within the browser's sandboxed environment.
From an operational perspective, this vulnerability allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The significance of executing code within the sandbox cannot be overstated, as modern browsers rely on strict isolation mechanisms to prevent web content from accessing sensitive system resources or user data. While the sandbox provides a layer of defense against full system compromise, bypassing it through memory corruption techniques like use-after-free can lead to further privilege escalation attacks. An attacker could potentially escape the browser's security boundaries, gaining access to local files, cookies, session tokens, and other confidential information stored by the user. This transforms what might otherwise be a contained web-based exploit into a significant threat vector for data theft or malware installation on the victim's machine.
The technical nature of this flaw aligns with Common Weakness Enumeration (CWE) category CWE-416, which defines use-after-free errors as a result of improper memory management practices. These vulnerabilities are particularly dangerous because they often do not cause immediate crashes but instead leave the system in an unstable state that can be triggered under specific conditions to achieve code execution. The exploitation typically involves crafting malicious HTML and JavaScript content designed to trigger the race condition or logic error within Turbolev, causing the browser to access freed memory regions. By carefully controlling the contents of these freed memory blocks through subsequent allocations, attackers can overwrite function pointers or object vtables, thereby redirecting program flow to their own shellcode. This technique is a staple in advanced persistent threat campaigns and zero-day exploits targeting widely used software like Google Chrome.
In terms of detection and mitigation strategies, this vulnerability falls under the MITRE ATT&CK framework's T1203 category for Exploitation for Client Execution, specifically involving web browsers as the attack vector. Defenders should prioritize patching all instances of Google Chrome to version 156.0.8078.73 or later immediately upon availability. For organizations unable to update instantly, implementing strict content security policies and restricting script execution on untrusted domains can reduce the likelihood of successful exploitation. Additionally, enabling sandbox enforcement features such as site isolation helps limit the blast radius if a vulnerability is triggered by ensuring that each tab runs in its own process with limited permissions. Security teams should also monitor for indicators of compromise associated with browser-based exploit kits and ensure that endpoint detection and response solutions are configured to flag unusual memory access patterns or suspicious child processes spawned from web browsers.