Google Chrome: Memory corruption in Media component
Summary
A memory corruption flaw in the Media component of Google Chrome before 156.0.8078.73 can be triggered by a crafted HTML page. An attacker who lures a user to such a page may potentially execute arbitrary code inside the browser sandbox. Exploitation requires the victim to open the page, and no privileges are needed. Chromium rates the issue as High.
Affected
- Google Chrome desktop prior to 156.0.8078.73
Fixed in
- Google Chrome desktop 156.0.8078.73 or later (Windows, Mac and Linux, per the vendor's Stable Channel Update of 27 Oct 2026)
- Later stable builds have been reported; install the newest stable build
- Other Chromium-based browsers (e.g. Microsoft Edge, Brave, Vivaldi): check each vendor's advisory, not verified
- Ubuntu chromium-browser package: listed as not affected, as it installs the Chromium snap; snap update status unknown
Workaround
No vendor workaround known. Applying the update is the fix.
Exploitation
- No evidence of exploitation in the wild found as of the research date
- Not listed in CISA KEV
- No public proof of concept found; CISA SSVC lists exploitation as none and automatable as no
- EPSS is low (0.27 % per the CVE data, 0.22 % per a GitHub alert)
Our recommendation
- Update Google Chrome on all desktops to the newest stable version without delay, given the drive-by browsing risk
- Check that updates are applied and that Chrome has been relaunched, as updates only take effect after a restart
- Check whether other Chromium-based browsers in use have received their own fixes
- Monitor for exploitation reports and raise the priority if they appear
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue 572878518 issues.chromium.org
- Ubuntu security notice CVE-2026-118327 ubuntu.com
- Malwarebytes: Chrome and Firefox updates fix serious security flaws www.malwarebytes.com
- Tenable Nessus plugin 372646 www.tenable.com
- OffSeq threat radar CVE-2026-118327 radar.offseq.com
- GitHub vulnerability alert astruzocyber/CVE issue 3395 github.com
- VulDB CVE-2026-118327 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:03.
Original description (NVD)
Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.