Microsoft points Edge customers to Chromium fix for CVE-2026-118313

Microsoft says Edge addresses CVE-2026-118313 by ingesting the Chromium fix and points customers to Google Chrome Releases instead of an Edge-specific patch, as listed in its security update guidance.

The flaw is a use-after-free, a memory error in which code references memory after freeing it, in Video affecting Microsoft Edge. Microsoft’s security update guidance scores it CWE-416, CVSS 8.8 High, and EPSS 0.27 percent. The upstream Chromium record says the flaw affects Google Chrome before version 156.0.8078.73 and lets a remote attacker run arbitrary code inside the sandbox through a crafted HTML page.

Chromium rates the flaw High, while SUSE lists its state as Resolved and separately rates it critical. It tracks the CVE under Bugzilla entry 1288218, marked IN_PROGRESS, with no SUSE Security Announcements cross-referenced, and links to MITRE. SUSE created the page on Oct. 28, 2026 and last modified it on Oct. 31, 2026.

Microsoft’s guidance also logs related Chromium-derived Edge flaws assigned by Chrome: CVE-2026-118359, CVE-2026-118358, CVE-2026-118357, and CVE-2026-118356. They are memory corruption in V8, memory corruption in WebAudio, use-after-free in FileSystem, and use-after-free in WTF.

Google released Chrome 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux, fixing 52 vulnerabilities: four critical, 46 high-severity, and two medium-severity. The four critical flaws are in FileSystem, FileAPI, Skia, and Layout. The fixes cover file handling, page rendering, JavaScript, graphics, video, and audio processing and roll out to devices over the coming days and weeks. Google tells Chrome users to install any update from Help or About and relaunch, while Linux users should use their package manager, and administrators should keep automatic updates enabled on managed Windows devices.

Google is withholding some Chrome bug details until most users install the fixes, and restrictions on shared libraries affecting other projects may last longer. The Chrome 156 notice gives no detailed exploit conditions for the high-severity issues. It credits Mozilla, Anthropic, Ada Logics, and OpenAI Codex Security among others, though several reports name AI assistance without establishing that the tools independently discovered or verified every issue.

This Chrome 156 release follows an earlier Chrome 156 update that fixed 353 security flaws and a separate update that addressed 32 vulnerabilities. Chrome 156 also fixed CVE-2026-118333, a missing authorization issue in Video, plus CVE-2026-118318 (V8 access control) and CVE-2026-118342 (Editing out-of-bounds write). Anthropic’s Xinyang Ge, assisted by Claude, reported Chrome FileSystem memory corruption CVE-2026-118306 on Oct. 7, 2026, and CVE-2026-118331, improper input validation in Chrome FileAPI, on Oct. 11, 2026.

Google points to its Chromium Security page for details on coordinated vulnerability disclosure.