Skip to content
OpenAdvisories
High · 8.8 CVE-2026-118317 EUVD-2026-111432GHSA-p6mv-27j3-mfcc

Use after free in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a…

Published Oct 27, 2026 · Updated Nov 3, 2026 · Assigned by Chrome

Description

Use after free in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected products

VendorProductAffectedFixed
Google Chrome 156.0.8078.73 – < 156.0.8078.73 156.0.8078.73

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 chromium 156.0.8078.73-1 —
Debian 13 chromium 156.0.8078.73-1~deb13u1 —
Debian 12 chromium 156.0.8078.73-1~deb12u1 —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed chromium 156.0.8078.73-1.1 openSUSE-SU-2026:12359-1
openSUSE Leap 16.0 chromium 156.0.8078.73-bp160.1.1 openSUSE-SU-2026:22202-1

Advisories 3

References