CVE-2026-118306

Think of Chrome's FileSystem feature as a filing cabinet the browser uses behind the scenes. This bug means a booby-trapped webpage could jam that cabinet in a way that lets an intruder slip past the lock and run their own instructions on your computer, outside the browser's normal safety box.

This matters to you if anyone in your business uses Google Chrome to browse the web — which is essentially every business. The risk only materializes if someone visits or is tricked into opening a malicious webpage, since the attack requires a user to interact with crafted content.

There is no evidence yet that attackers are exploiting this flaw in the wild, and no public exploit code exists, but the severity is high enough that it warrants prompt attention rather than emergency action. Update within your normal patching cycle this week rather than waiting for the next scheduled refresh.

To confirm exposure, audit browser versions across all endpoints (via chrome://version or your endpoint management console) and flag any instance below 156.0.8078.73. The fix is a straightforward Chrome update to 156.0.8078.73 or later with no known breaking changes, since this is a security-only patch. Chrome typically auto-updates on restart, so the main remediation gap is machines that haven't been restarted in a while — enforce a restart policy or push updates via your MDM/Chrome Enterprise policy if managing many devices. There is no viable workaround short of updating or avoiding untrusted websites entirely, which isn't practical. Monitor for any shift in exploitation status (KEV listing, new exploit code, or EPSS score increase) that would elevate urgency.

CVSS 3.1 score is 9.6 (Critical), with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H indicating network-exploitable, low complexity, no privileges required, but requiring user interaction, with scope change and high impact to confidentiality, integrity and availability. The weakness is CWE-119 (memory corruption) in Chrome's FileSystem component, potentially enabling sandbox escape and arbitrary code execution via a crafted HTML page. It is not listed in CISA's Known Exploited Vulnerabilities catalog, no public exploit code is known to exist, and predicted exploitation likelihood is low with a flat trend — exploit maturity is currently theoretical/proof-of-concept absent. Press attention is newly emerging but should not be treated as evidence of active exploitation.