1950s pulp-style illustration of a cream and red warning robot with beacon beside a cracked chrome window frame in starry space, navy red and chrome on aged paper, no text

Chrome 156: FileSystem RCE outside the sandbox (CVE-2026-118306)

Home » Alert » Chrome 156: FileSystem RCE outside the sandbox (CVE-2026-118306)

ALERT · Critical — patch available. Last updated 28 October 2026. See the Alert Tracker

If your estate still runs Google Chrome below 156.0.8078.73 (Linux) or 156.0.8078.73/.74 (Windows and Mac), treat this Stable update as urgent. Microsoft Edge is aware of the Chromium fixes and has not yet shipped its matching build.

What it is

On 27 October 2026 Google pushed Chrome Stable 156.0.8078.73/.74 (Windows/Mac) and 156.0.8078.73 (Linux) with 52 security fixes. Four are Chromium-severity Critical. The lead issue is CVE-2026-118306 (opens in a new tab): memory corruption in FileSystem that can let a remote attacker run code outside the sandbox via a crafted HTML page (CWE-119). NVD lists CVSS 3.1 9.6 from CISA’s ADP (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H); Google rates Chromium severity Critical and does not publish a CVSS. The other Criticals — CVE-2026-118331 (opens in a new tab) (FileAPI), CVE-2026-118348 (opens in a new tab) (Skia) and CVE-2026-118344 (opens in a new tab) (Layout use-after-free) — are inside-sandbox RCE at CVSS 3.1 8.8.

Who is affected

Any user or managed device on Chrome prior to the builds above, and Chromium browsers that lag Stable. As of 27 October, Microsoft’s Edge notes say the company is aware of the Chromium fixes and is actively working on a release; Stable 156.0.4314.42 (22 October) does not yet include them.

Exploitation status

Google’s Stable post does not state that an exploit exists in the wild. None of the four Criticals appear in the CISA KEV catalogue (version 2026.10.28). CISA’s SSVC record for CVE-2026-118306 lists exploitation as none. FIRST EPSS (28 October) for all four sits around 0.0024 (~15th percentile). Patch priority comes from severity and sandbox escape, not from confirmed mass exploitation.

Fix and mitigation

Update Chrome to 156.0.8078.73 or newer (Windows/Mac also list .74). Confirm the version under chrome://settings/help or your enterprise management console, and restart so the new binary is running. For Edge, watch the Edge security release notes (opens in a new tab) and apply the Chromium-aligned build when Microsoft publishes it. Until then, keep browsing habits tight on high-risk users and ensure auto-update is not blocked by policy.

How to hunt

There is no public exploitation telemetry for these CVEs, so Hunt Lab is not shipping a behavioural pack. Inventory unpatched browsers instead — for example Defender XDR / Microsoft Sentinel:

DeviceTvmSoftwareInventory
| where SoftwareName in~ ("chrome", "google chrome", "microsoft edge", "edge")
| where iff(SoftwareName has "edge",
        // Edge Chromium fix for these Criticals not shipped as of 28 Oct 2026 — flag all Edge until Microsoft publishes the aligned build
        true,
        parse_version(SoftwareVersion) < parse_version("156.0.8078.73"))
| summarize Devices=dcount(DeviceId) by SoftwareName, SoftwareVersion
| order by Devices desc

Tune the Edge version predicate once Microsoft’s fixed build number is public. Retire any “allow older Chrome” policy exceptions while the Criticals remain unpatched.

Sources

Correction, 28 October 2026: Headline shortened to the house limit. The CVSS 3.1 9.6 score is attributed to CISA’s ADP on NVD, not to NVD or Google. The sample KQL no longer excludes all Edge 156.0.* builds — Edge stays flagged until Microsoft ships its fixed build. A further fix replaces the Chrome branch’s startswith "156.0.8078" test with parse_version(SoftwareVersion) < parse_version("156.0.8078.73") so only builds below the patched release are flagged.

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)