Microsoft Edge patches Media memory flaw through Chromium Update

On October 30, 2026, Microsoft released Microsoft Edge Stable Version 156.0.4314.58 with Chromium security updates. Microsoft Edge Stable Version 156.0.4314.56 shipped on October 29, 2026, and Microsoft Edge for Android Version 155.0.4283.61 arrived on October 19, 2026. Microsoft Edge Stable Version 155.0.4283.62 came out on October 16, 2026, followed by Microsoft Edge Stable Version 154.0.4258.62 on October 05, 2026, each incorporating the latest Chromium security updates. Microsoft’s Edge security release notes say CVE identifiers will be added when available for the October 30 and October 29, 2026 releases.

The release notes for those two Stable channel versions include a note that CVE details are pending.

PremierePC said Microsoft Edge deals with CVE-2026-118311 by pulling in the Chromium fix from upstream and sends readers to Google Chrome Releases for details. Chrome gave the CVE identifier CVE-2026-118311. Microsoft put the memory corruption flaw in Media, tracked as CVE-2026-118311, into its security update guidance for Microsoft Edge. Edge is Chromium-based and ingests Chromium, which contains the fix for the vulnerability, making the upstream Chromium patch the delivery path for Edge users.

The vulnerability affects Google Chrome before version 156.0.8078.73. In those versions, a remote attacker might run arbitrary code inside the sandbox using a crafted HTML page. The fix for Chromium arrived in Google Chrome 156.0.8078.73. Chromium gives CVE-2026-118311 a High severity rating, classifies the weakness as CWE-119 (a memory-buffer bounds flaw that lets data move past its intended limits), and lists the CVSS v3 vector as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (a standard string that scores exploitability and impact).

CVE-2026-118311 was published on October 27, 2026, marking the publication date of the vulnerability record.

NVD lists the status as Analyzed and shows the record last modified on October 29, 2026. CISA-ADP gave CVE-2026-118311 a CVSS 3.1 score of 8.8 on October 28, 2026. CISA ADPSSVC made no decision for CVE-2026-118311 on October 28, 2026. OpenCVE found no SSVC decision for CVE-2026-118311, known since October 30, 2026.

Other identifiers for the same flaw are EUVD-2026-111453 and GHSA-47m4-pr5w-69g4.

Ismalicious said no exploitation had been reported by the sources it read for CVE-2026-118311, reflecting the exploitation status per Ismalicious sources. PremierePC gave an EPSS probability of 0.27 percent for CVE-2026-118311 in its alert. Ismalicious refreshed its observed activity corpus for CVE-2026-118311 on November 1, 2026 at 15:37 UTC, providing a timeline entry showing when its corpus was last updated for this CVE.

The openSUSE-SU-2026:12359-1 advisory covers CVE-2026-118311 along with other CVEs. Ismalicious lists this openSUSE advisory under identifiers for the same flaw and describes it as an openSUSE advisory with an unstated license.

For CVE-2026-118311, Debian 13 chromium ships the fix in version 156.0.8078.73-1~deb13u1. No fixed version appears for chromium on Debian 14. Ismalicious displays distribution build data from OSV.dev showing that the Debian 14 build of chromium carries the vulnerability but lacks a recorded fixed version.

ProjectDiscovery does not list a Nuclei template for CVE-2026-118311. Exploit-DB does not have an entry for CVE-2026-118311. No proof-of-concept repositories appear for CVE-2026-118311 on PoC-in-GitHub. Metasploit Framework does not list modules for CVE-2026-118311.