Loading vulnerability…
HTML Memory Corruption in Google Chrome
CVE-2026-118317 is a high-severity memory corruption vulnerability in the HTML functionality of Google Chrome before version 156.0.8078.73. Processing a crafted HTML page can potentially allow a remote attacker to execute arbitrary code inside the browser sandbox. Chromium-based Microsoft Edge and downstream Chromium packages are also affected. The specific vulnerable function and underlying memory-corruption mechanism are not publicly specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could permit arbitrary code execution within the browser sandbox, compromising confidentiality, integrity, and availability within that restricted execution context. This vulnerability alone does not establish a sandbox escape, host-level code execution, or privilege escalation.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is identified. Until patching is complete, reduce exposure to untrusted web content through web filtering and browsing restrictions, retain browser sandboxing and anti-exploitation protections, and run the browser without administrative privileges. These controls do not eliminate the vulnerability or replace updating.
Patch, then assume compromise.
Upgrade Google Chrome and Chromium to version 156.0.8078.73 or later and relaunch the browser. Upgrade Microsoft Edge to version 156.0.4314.58 or later. For Debian stable (trixie), install Chromium 156.0.8078.73-1~deb13u1 or later. For other distributions, install the corresponding vendor security update containing the Chromium fix; observe update-channel availability and any required session restart.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.