Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-118337: Chrome before 156.0.8078.73 can run malicious code

CVE-2026-118337 · published 8 days ago

Summary

Versions of Google Chrome and Chromium older than 156.0.8078.73 can be fooled by a specially crafted web page to execute code inside the browser's protection layer. This could let an attacker take control of the browser session and potentially affect the computer. Update the browser to the latest version to close the gap.

What to do

Update debian chromium to version 156.0.8078.73-1~deb12u1.
Update debian chromium to version 156.0.8078.73-1~deb13u1.
Update google chrome to version 156.0.8078.73 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	google	chrome	< 156.0.8078.73
Debian:12	debian	chromium	< 156.0.8078.73-1~deb12u1 Fix: upgrade to 156.0.8078.73-1~deb12u1
Debian:13	debian	chromium	< 156.0.8078.73-1~deb13u1 Fix: upgrade to 156.0.8078.73-1~deb13u1

Original advisory text

Use after free in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

References

https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_... Release Notes Vendor Advisory
https://issues.chromium.org/issues/569286605 Permissions Required
https://security-tracker.debian.org/tracker/CVE-2026-118337 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

9.3 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-284Improper Access Control

CWE-416Use After Free

Timeline

Published27 Oct 2026

Updated4 Nov 2026

First seen27 Oct 2026

Sources

CVE-2026-118337 · NVD

CVE-2026-118337 · MITRE

DEBIAN-CVE-2026-118337 · OSV

Track software like this

Free during beta