Loading vulnerability…
Use-after-free in Google Chrome Layout
CVE-2026-118344 is a use-after-free vulnerability in Google Chrome's Layout component affecting versions before 156.0.8078.73. Processing a specially crafted HTML page can cause the browser to access previously freed memory, allowing a remote attacker to execute arbitrary code inside the browser sandbox. Chromium classifies the vulnerability as Critical. Chromium-based Microsoft Edge also incorporates the affected component.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution within the browser sandbox, compromising the confidentiality, integrity, and availability of resources accessible to the affected sandboxed process. The vulnerability alone does not establish sandbox escape or host-level code execution.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Until updates are deployed, reduce exposure using web filtering to block malicious or unapproved sites and restrict unnecessary JavaScript where operationally feasible. Retain browser sandboxing and available anti-exploitation protections, and run the browser without administrative privileges. These measures do not eliminate the vulnerability or replace patching.
Patch, then assume compromise.
Upgrade Google Chrome to 156.0.8078.73 or later; the fixed Stable releases are 156.0.8078.73/.74 for Windows and macOS and 156.0.8078.73 for Linux. Relaunch Chrome after installation. Upgrade Microsoft Edge to 156.0.4314.58 or later. For distribution-managed Chromium installations, install the applicable vendor security update; Debian trixie provides the fix in 156.0.8078.73-1~deb13u1. Update affected FreeBSD chromium and ungoogled-chromium packages through the vendor package channel. Follow distribution-specific session restart requirements.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.