Google Chrome: Use after free in FileSystem allows sandboxed code execution
Summary
Google Chrome versions before 156.0.8078.73 contain a use-after-free flaw in the FileSystem API. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. Exploitation requires that a user loads the malicious page, and the sources do not say whether a further sandbox escape is needed.
Affected
- Google Chrome (desktop) before 156.0.8078.73
- Exact affected builds per platform: unknown; sources disagree on the build numbers.
Fixed in
- Google Chrome 156.0.8078.73 or later (Windows and Mac: 156.0.8078.73/.74 according to secondary sources; Linux: 156.0.8078.73)
- Install the newest stable build on each platform, as later builds also fix related FileSystem flaws.
Workaround
- Unknown. No workaround is documented in the sources; updating the browser is the fix.
Exploitation
- No evidence of exploitation in the wild found; CISA KEV listing not reported by the sources reviewed.
- No public proof-of-concept found; this does not prove none exists.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS: 0.28% (percentile 21).
Our recommendation
- Update Google Chrome on all systems to the newest stable build now and enforce a browser restart.
- Check the Chrome version across all endpoints, including user profiles that may not auto-update.
- Apply the same update to other Chromium-based browsers once their vendors release the fix.
- Monitor for vendor updates and treat the NVD score of 8.8 as the priority basis.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium bug tracker issues.chromium.org
- VulDB CVE-2026-118357 vuldb.com
- OffSeq Radar CVE-2026-118357 radar.offseq.com
- Strix CVE-2026-118357 www.strix.ai
- Ubuntu Updates: google-chrome-stable www.ubuntuupdates.org
- TheHackerWire CVE-2026-118357 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:47.
Original description (NVD)
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.