Loading vulnerability…
Use-after-free in Google Chrome Animation
CVE-2026-118339 is a high-severity use-after-free vulnerability in the Animation component of Google Chrome before version 156.0.8078.73. A remote attacker can trigger the flaw through a crafted HTML page to execute arbitrary code inside the browser sandbox. Chromium-based browsers, including Microsoft Edge, inherit the vulnerability. The specific vulnerable function and memory-lifetime sequence are not available.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution within the browser sandbox, potentially compromising the confidentiality, integrity, and availability of resources accessible to the affected process. This vulnerability alone does not establish sandbox escape, elevated privileges, or unrestricted operating-system access.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Until updates are installed, reduce exposure to untrusted web content through URL filtering and browsing restrictions. Retain browser sandboxing and available anti-exploitation protections, and run the browser without administrative privileges. These defense-in-depth measures do not eliminate the vulnerability or replace patching.
Patch, then assume compromise.
Upgrade Google Chrome and affected Chromium packages to version 156.0.8078.73 or later, or install the corresponding vendor-patched package. For Microsoft Edge, upgrade to version 156.0.4314.58 or later. Debian trixie provides the fix in Chromium 156.0.8078.73-1~deb13u1. Other distributions should install their applicable Chromium security update, checking availability because some Fedora and EPEL builds were pending testing. Relaunch the browser after updating; Fedora and EPEL update notices additionally require logging out and back in.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.