Microsoft added CVE-2026-118334, an ImageCapture use-after-free vulnerability in Google Chrome, to its Microsoft Edge security update guidance on Oct. 31, 2026.
Chrome versions before 156.0.8078.73 are vulnerable, and 156.0.8078.73 is the patched version. Chromium rates the flaw High and maps it to CWE-416, use after free. cvefeed.io received it as a new CVE on Oct. 27, 2026, completed initial analysis on Oct. 28, 2026, and modified the entry on Oct. 28 and Oct. 29, 2026.
Edge inherits the flaw because Microsoft Edge is Chromium-based and ingests Chromium; Google’s upstream patch addresses it, and Chrome assigned the CVE identifier. Microsoft attributes the CVE to Chrome and points to Google Chrome Releases for patch details. Microsoft’s feed lists an EPSS (Exploit Prediction Scoring System) probability of 0.26 percent for the flaw.
The flaw was publicly disclosed on Oct. 27, 2026. TheHackerWire reports that no one has confirmed any public exploit code, and CISA’s Known Exploited Vulnerabilities catalog does not list the flaw as actively exploited in the wild.
Join the discussion