Microsoft adds Chrome FileSystem flaw to Edge guidance

cvefeed.io says Google released a Chrome desktop security update on October 27, 2026. Microsoft listed CVE-2026-118357, a use-after-free flaw in Chrome’s FileSystem component, in its security update guidance for Chromium-based Edge. PremierePC reported that Microsoft added CVE-2026-118357, described as a use-after-free in Edge’s FileSystem, to its security update guidance, formally incorporating the flaw into Microsoft’s own guidance for Edge.

cvefeed.io and CTIWatch say the flaw is a use-after-free weakness in Chrome’s FileSystem component affecting versions before 156.0.8078.73, and Chromium rates its severity High. OpenCVE and CTIWatch say the flaw falls under CWE-416, meaning the weakness allows access to memory after the system frees it and can open the path to arbitrary code execution. OpenCVE, CTIWatch and PremierePC say CVSS, the vulnerability scoring system, rates the flaw at a base score of 8.8.

Every Google Chrome installation on desktop platforms that runs an older version than 156.0.8078.73 is affected, and that group includes 2026.10 stable builds below that number. Microsoft Edge obtains the patch through Chromium, since the browser is built from ingested Chromium code. The correction comes through the shared Chromium codebase.

The flaw permits a remote attacker to execute arbitrary code inside the sandbox through a crafted HTML page. The attack comes from the network, calls for no privileges, and still demands that a user interact with the page. OpenCVE describes the trigger as a crafted HTML page that reprograms a reference to freed memory, allowing arbitrary code execution in Chrome’s sandbox through the FileSystem API, a mechanism that goes beyond the general effect of running code inside the sandbox.

CTIWatch says a successful exploit causes complete confidentiality breach, full integrity compromise, and availability disruption. OpenCVE says the possible damage covers running malicious binaries with browser process privileges, pulling session data out, and changing or removing local files.

OpenCVE judges exploitability as moderate and impact as high, though no current exploitation evidence exists. The flaw does not appear in CISA’s Known Exploited Vulnerabilities catalog, which indicates no documented exploited attacks as of the assessment.

The EPSS (Exploit Prediction Scoring System) probability for the flaw is below 1%, while PremierePC reports an EPSS probability of 0.28%. CTIWatch says the flaw requires user interaction to exploit, a condition that slightly reduces the risk of mass automated attacks. CTIWatch says network-based remote exploitation requires no physical or adjacent access and broadens the attack surface. OpenCVE says a victim must visit a malicious web page for the attack to work, a pattern consistent with drive-by or phishing delivery.

cvefeed.io recorded CVE-2026-118357 on Oct. 27, 2026, completed initial analysis on Oct. 28, 2026, and modified the entry on Oct. 29, 2026. Its vulnerability history also lists a modification on Oct. 28, 2026, adding another dated change to the record alongside the receipt, initial analysis, and later modification. The outlet also says Google put out a Chrome desktop security update on October 27, 2026, covering 52 vulnerabilities with four rated Critical.

Microsoft’s security update guidance identifies CVE-2026-118357 as a use-after-free in FileSystem that affects Chromium-based Microsoft Edge. Chrome assigned the CVE, and Microsoft points readers to Google’s Chrome Releases blog instead of its own technical analysis, leaving the documentation to Google.

CTIWatch urges defenders to apply vendor patches immediately for CVE-2026-118357. It also recommends monitoring the CVE in threat-intelligence feeds and reviewing intrusion detection and prevention system (IDS/IPS) signatures for exploitation attempts. These steps form the response guidance for defenders tracking potential exploitation of the FileSystem flaw.