Description
Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-10-27
Score: n/a
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a use-after-free in the Paint component of Google Chrome prior to version 156.0.8078.73. A malicious HTML page can free a memory object and then access it again, allowing execution of arbitrary code with the sandbox’s privileges. The flaw is identified as CWE-416 and can potentially lead to privilege escalation or data exfiltration if the sandbox boundaries are breached.

Affected Systems

Google Chrome browsers on desktop platforms that are older than version 156.0.8078.73.

Risk and Exploitability

Chromium lists this as a high‑severity issue. The EPSS score is not available and the vulnerability is not in the CISA KEV catalog. The most likely attack vector is a remote attacker delivering a crafted web page that the user opens or visits in Chrome; exploitation requires the user to interact with the malicious content in the browser.

Generated by OpenCVE AI on October 28, 2026 at 00:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to 156.0.8078.73 or later on all user machines.
  • Configure Chrome enterprise policy to enforce automatic updates so the patch is applied without manual intervention.
  • Monitor user activity for anomalous process behavior and, if possible, block or quarantine suspicious content until a permanent fix is deployed.

Generated by OpenCVE AI on October 28, 2026 at 00:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 27 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
Description Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-27T23:03:13.760Z

Reserved: 2026-10-27T21:20:07.555Z

Link: CVE-2026-118307

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T23:16:59.203

Modified: 2026-10-27T23:16:59.203

Link: CVE-2026-118307

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T01:45:11Z

Weaknesses