Loading vulnerability…
Sandboxed Code Execution in Google Chrome Paint
CVE-2026-118353 is a use-after-free vulnerability in the Paint component of Google Chrome before version 156.0.8078.73. A remote attacker can trigger the flaw through a crafted HTML page to execute arbitrary code inside the browser sandbox. Chromium classifies the vulnerability as High severity. Chromium-based Microsoft Edge and downstream Chromium packages are also affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution within the browser sandbox, compromising the confidentiality, integrity, and availability of resources accessible to the compromised process. This vulnerability alone does not establish sandbox escape or unrestricted execution on the host operating system.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Until patched, reduce exposure using web filtering to restrict malicious or unapproved sites, preserve browser sandboxing and available anti-exploitation protections, and run the browser under a non-administrative account. These measures do not eliminate the vulnerability or replace updating.
Patch, then assume compromise.
Upgrade Google Chrome and affected Chromium packages to version 156.0.8078.73 or later, or install the corresponding vendor-fixed package. For Microsoft Edge, upgrade to version 156.0.4314.58 or later. Debian trixie provides the fix in Chromium 156.0.8078.73-1~deb13u1. Restart the browser after updating and verify the installed build. Fedora and EPEL update notices additionally require logging out and back in; confirm update-channel availability because some builds were pending testing.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.