External risk intelligence

Google Chrome FileSystem Memory Corruption Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-118306

This vulnerability affects a web browser, which is an application designed to actively navigate and render content from the public internet. While it requires user interaction, the browser itself is a primary, internet-facing client application that is frequently exposed to untrusted remote content in typical real-world deployments.

Memory Corruption

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical memory corruption vulnerability has been identified in Google Chrome, allowing for potential code execution outside of its security sandbox through a malicious web page. While requiring user interaction, the widespread use of Chrome makes this a significant concern for confirming relevance and exposure across the organization.

Browser flaw could allow code execution.
Widespread use demands attention.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious web page. This page would then exploit a memory corruption flaw in Chrome's FileSystem component. If successful, this could allow code execution outside the browser's safe environment, potentially leading to broader system compromise.

Requires user interaction.
Triggered via a crafted HTML page.
Risk of code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

A memory corruption vulnerability in Google Chrome's FileSystem component could allow a remote attacker to execute arbitrary code outside the browser's sandbox when a user visits a specially crafted HTML page. This could lead to a compromise of the user's system.

System code execution outside sandbox.
Visiting malicious HTML page.
Potential system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Google Chrome's FileSystem component requires immediate attention from teams managing user-facing applications and browser deployments. The first step is to identify all instances of the affected browser, determine their exposure and business criticality, and confirm ownership. Subsequently, a plan for remediation, which may involve coordination with Google or browser management teams, should be developed based on the assessed risk.

Identify affected browser instances and ownership.
Verify reachability and business criticality.
Plan remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the FileSystem component in Google Chrome?

Google Chrome is a web browser used for accessing the internet. The FileSystem component is an internal part of the browser's architecture that handles how web applications read, write, and manage files on a local device. It is designed to allow websites to interact with a sandboxed file environment safely.

What does memory corruption mean in CVE-2026-118306?

Memory corruption is a type of software weakness, classified here as CWE-119, where a program accidentally accesses or modifies memory it should not touch. In this CVE, the vulnerability allows an attacker to manipulate how the FileSystem handles data, potentially tricking the browser into executing malicious code outside of its normal security constraints.

How is this Chrome vulnerability triggered?

An attacker triggers this flaw by luring a user to visit a malicious or specially crafted HTML page. The vulnerability is not triggered by background processes or automated connections; it requires a user to actively navigate to the harmful content within the browser.

Why is this CVE considered relevant for my organization?

Halo Surface Signal flags this as relevant because web browsers are designed to interact directly with the public internet, making them frequent targets. Since Chrome is widely used to render untrusted content, the ability of a single webpage to bypass the browser's sandbox environment poses a significant risk to the security of the host system.

Do I need to update my software to address this issue?

Yes. The primary response involves identifying all systems where Google Chrome is installed. Once you have an inventory, coordinate with your browser management teams to confirm that these instances are updated to version 156.0.8078.73 or higher, which resolves the memory corruption flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.