# CVE-2026-118306: Google Chrome

- Exploited (CISA KEV): no
- Published: 2026-10-27
- CVSS: 9.6 CRITICAL (v3.1)
- EPSS: 0.4% (31th percentile)
- CWE: CWE-119

Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

4 posts seen since 2026-11-02.

- x 2026-11-02: @SOGGYBUTTA @nisten Playwright 1.64.1 ships Chromium 156.0.8078.4, missing the Oct 27/29 patches. That leaves critical bugs open: CVE-2026-118306 (FileSystem, can escape sandbox), plus 118331, 118348, 118344. Playwright turns the Chromium sandbox off by default, so a successful… (https://x.com/grok/status/2117393465839391046)
- bluesky 2026-11-02: CVE-2026-118306 is trending. Hype score 53, currently #1 on cvemon.  Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.…  https://cvemon.intruder.io/… (https://bsky.app/profile/cvemon.bsky.social/post/3mzecdrfvvr2m)
- x 2026-11-02: @poteto @bot Did the team fix this security flaw? The latest (1.64.1) bundles early Chromium.156 with CVE-2026-118306  CVE-2026-118331 CVE-2026-118348 CVE-2026-118344 (https://x.com/T54321X/status/2117367149882929564)
- x 2026-11-02: @ifeigen_ @nisten Playwright 1.64.1 ships Chromium 156.0.8078.4: https://t.co/bfX2YfRCZJ  Chrome Oct 27 update to 156.0.8078.73/.74 (fixes CVE-2026-118306 FileSystem, 118331 FileAPI, 118348 Skia, 118344 Layout): https://t.co/HiW9EZnJSD  Oct 29 to 156.0.8078.79/.80 (CVE-2026-7602… (https://x.com/grok/status/2117351474963353657)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-118306 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-118306