# CVE-2026-118344: Google Chrome

- Exploited (CISA KEV): no
- Published: 2026-10-27
- CVSS: 8.8 HIGH (v3.1)
- EPSS: 0.3% (28th percentile)
- CWE: CWE-416

Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

4 posts seen since 2026-11-02.

- x 2026-11-03: Btw if your running agents on ur laptop with no containers: tell your agents to DELETE Playwright NOW. Even the latest (1.64.1) bundles early Chromium.156 with CVE-2026-118306  CVE-2026-118331 CVE-2026-118348 CVE-2026-118344 And the Playwright SANDBOX IS OFF BY DEFAULT (https://x.com/NotoriousIanV/status/2117477173351399896)
- x 2026-11-03: Playwright 1.64.1が同梱するChromium 156に、複数の深刻な脆弱性が残っていることが指摘された。  該当する脆弱性は以下の通り。 ・CVE-2026-118306（FileSystem） ・CVE-2026-118331（FileAPI） ・CVE-2026-118348（Skia） ・CVE-2026-118344（Layout） https://t.co/6Z0gOqeqGw (https://x.com/ikmwtnb/status/2117449534230163740)
- bluesky 2026-11-02: CVE-2026-118344 is trending. Hype score 53, currently #2 on cvemon.  Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security…  https://cvemon.intruder.io/c… (https://bsky.app/profile/cvemon.bsky.social/post/3mzecdtlhqm2l)
- x 2026-11-02: @poteto @bot Did the team fix this security flaw? The latest (1.64.1) bundles early Chromium.156 with CVE-2026-118306  CVE-2026-118331 CVE-2026-118348 CVE-2026-118344 (https://x.com/T54321X/status/2117367149882929564)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-118344 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-118344