CVE-2026-118313: Use After Free
Published Oct 27, 2026
·Updated
Use after free in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
1 affected component
Google Chrome<156.0.8078.73
Event History
Oct 27, 2026
CVE Published
via MITRE·11:03 PM
Data Sourced
via MITRE·11:03 PM
DescriptionWeakness
Data Sourced
via NVD·11:16 PM
DescriptionWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Users of Google Chrome versions earlier than 156.0.8078.73 are exposed when they visit a crafted HTML page.
2
What does an attacker need to exploit it?
The attacker needs to cause the target to process a crafted HTML page remotely. Successful exploitation can execute arbitrary code inside Chrome's sandbox.
3
Does successful exploitation escape the Chrome sandbox?
No sandbox escape is described. The reported impact is arbitrary code execution inside the sandbox.