A use-after-free flaw in Google Chrome’s Paint component, tracked as CVE-2026-118307, was publicly disclosed Oct. 27, 2026, and affects desktop versions of Chrome older than 156.0.8078.73. Sources: cvefeed.io, app.opencve.io, TheHackerWire, Strix
The flaw is a memory management error in Chrome’s Paint component. A remote attacker can potentially run arbitrary code inside the browser’s sandbox through a specially crafted HTML page, but only if a user opens or visits malicious content; the code runs with the privileges of the sandbox. Breaching sandbox boundaries could lead to privilege escalation or data exfiltration. Sources: cvefeed.io, app.opencve.io, TheHackerWire, Strix
Microsoft Edge is affected as well because it uses the Chromium engine. Chromium rates the security severity as High, and CVE-2026-118307 carries a CVSS score of 8.8; the flaw is tracked as CWE-416, a use-after-free memory weakness. Sources: cvefeed.io, app.opencve.io, TheHackerWire, Strix, PremierePC Technology Group
No public exploit code for the vulnerability has been confirmed, and CISA’s Known Exploited Vulnerabilities catalog does not list it. EPSS puts the score below 1 percent and estimates a 0.29 percent chance of exploitation within 30 days. The CVE record was received Oct. 27, 2026, modified Oct. 28, 2026 and Oct. 29, 2026, and initial analysis was recorded Oct. 29, 2026. Sources: cvefeed.io, app.opencve.io, TheHackerWire, Strix
Join the discussion