CVE-2026-118306: Memory corruption in Chrome FileSystem

CVE-2026-118306 identifies a memory corruption in the FileSystem component of Google Chrome in versions prior to 156.0.8078.73. The vulnerability allows a remote attacker to execute arbitrary code outside the browser sandbox via a specially crafted HTML page. Concrete impact: complete system access for the user, bypass of browser protections, theft of sensitive data and local credentials.

The CVSS is 9.6 (critical), the maximum severity classification. Chromium declared critical security severity. The vulnerability was published by NIST on October 27, 2026. No active public exploits are reported at present, however the CVSS score reflects extremely high exploitation potential. Unofficial communications on X indicate that Playwright versions (at least up to 1.64.1) bundle Chromium affected by this CVE, with sandbox disabled by default in some configurations—information not verified through official channels.

Critical actions for defenders: immediately verify which Chrome version is in use across enterprise systems (Settings > About Chrome shows version). Check if automation tools (Playwright, Puppeteer, Selenium) that bundle Chromium are deployed and update to available patches. Enable Chrome automatic updates if not already active. Monitor browser and process logs for anomalous local filesystem resource requests. Educate users not to open untrusted HTML pages during this critical window.