Loading vulnerability…
Use-after-free in Google Chrome Paint
CVE-2026-118307 is a high-severity use-after-free vulnerability in the Paint component of Google Chrome before version 156.0.8078.73. Processing a crafted HTML page can trigger the memory-safety flaw, potentially allowing a remote attacker to execute arbitrary code inside the browser sandbox. Chromium-based products incorporating the affected component, including Microsoft Edge, are also affected. The specific vulnerable function and detailed triggering conditions are not publicly specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could compromise confidentiality, integrity, and availability within the affected sandboxed browser process through arbitrary code execution. The vulnerability-specific CVSS v3.0 base score is 8.8. This vulnerability alone does not establish sandbox escape or unrestricted execution with the logged-on user's operating-system privileges.
If you can’t patch tonight, do this now.
No vulnerability-specific interim workaround is documented. Until updates are deployed, reduce exposure to untrusted web content through URL filtering and browsing restrictions. Preserve browser sandboxing and anti-exploitation protections, and run the browser without administrative privileges. These measures do not replace patching.
Patch, then assume compromise.
Upgrade Google Chrome to version 156.0.8078.73 or later and relaunch the browser. Upgrade Microsoft Edge to version 156.0.4314.58 or later. For Debian trixie, update Chromium to 156.0.8078.73-1~deb13u1 or later. For other Chromium distributions, install the vendor's security update incorporating Chromium 156.0.8078.73 or later, following any distribution-specific session-restart requirements.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.