Google patches Chromium Animation use-after-free CVE-2026-118338 in Chrome 156.0.8078.73

On Oct. 27, 2026, Google patched CVE-2026-118338 in Chrome version 156.0.8078.73, a use-after-free weakness in Chromium’s Animation component.

The flaw affects Chrome versions before 156.0.8078.73 on Windows, macOS, and Linux. Users must update to Chrome 156.0.8078.73 or later, and downloading the update is not enough; users must restart the browser to apply the fix.

Chromium rates CVE-2026-118338 as medium severity and gives it a CVSS score of 8.8, which indicates high severity. The full CVSS v3 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, describing network access, low attack complexity, no privileges required, user interaction, and high impacts on confidentiality, integrity, and availability. NVD lists the record as Analyzed, meaning the flaw has completed National Vulnerability Database review, and the entry was last modified Oct. 29, 2026.

CVE-2026-118338 maps to CWE-416, a use-after-free weakness. The use-after-free flaw permits operations on freed memory, which can hijack control flow inside the browser process. If exploited, an attacker could break out of the sandbox and run code with the privileges of the Chrome process. Attackers might run arbitrary code inside the browser sandbox, which could lead to unauthorized access to sensitive data or system compromise.

Triggering the flaw requires user interaction, for example by visiting a malicious or compromised webpage. The probable attack vector is a malicious web page serving crafted animation data. No proof-of-concept exploits or active exploitation have appeared in public sources, and no exploitation has been reported by credible sources in the latest updates.

The flaw affects Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi, which rely on the same underlying Chromium codebase. Each vendor must release its own update that incorporates the Chromium fix.

Microsoft Edge inherits the fix through upstream Chromium patches instead of a separate Microsoft fix because it is Chromium-based. The flaw was assigned by Chrome and appears in Microsoft’s security update guidance for Microsoft Edge. PremierePC’s alert details identify the source feed as Microsoft MSRC and the affected product as Microsoft Edge. Microsoft tells users to visit the Google Chrome Releases blog for more information.

Linux distributions have packaged patched builds in broader security updates instead of standalone advisories. openSUSE issued advisory openSUSE-SU-2026:12359-1 covering the flaw among other CVEs. openSUSE Tumbleweed receives chromium in version 156.0.8078.73-1.1, while openSUSE Leap 16.0 receives 156.0.8078.73-bp160.1.1, and both receive patched Chromium builds tied to the upstream fix. Debian 13 has chromium fixed in 156.0.8078.73-1~deb13u1, but Debian 14 and Debian 12 show no fixed version in the source data.

The CVE record arrived as a new entry on Oct. 27, 2026, before reviewers added any analysis or modifications later that week. It received its initial analysis Oct. 28, 2026, the first analytical review of the record, and was modified Oct. 28 and Oct. 29, 2026, with two changes by the same record editor on back-to-back days after that review. It is tracked as GHSA-77gh-q2wq-jmhc in the GitHub Advisory Database and as EUVD-2026-111474 in ENISA EUVD.

CISA’s Known Exploited Vulnerabilities catalog does not list CVE-2026-118338, meaning CISA has not confirmed active exploitation in the wild. CISA’s ADP SSVC decision for the flaw is none, recorded Oct. 28, 2026, while OpenCVE records no SSVC decision, known since Oct. 30, 2026.

isMalicious updated its observed activity for the flaw on Nov. 1, 2026 at 21:37 UTC, though its page states that none of the sources it read reported exploitation. No Exploit-DB entry, no Metasploit modules, and no proof-of-concept repositories appear in the listings, backing the view that public exploitation tooling is not available. EPSS sits below 1 percent, suggesting limited observed exploitation likelihood, and PremierePC’s EPSS estimate for the flaw is 0.26 percent.