CVE-2026-118317
Chromium: CVE-2026-118317 Memory corruption in HTML
CVE-2026-118317 is fixed in 9 products on 3 platforms, first by Google Chrome Dev (EXE) 157.0.8081.0, released October 1, 2026. It is not reported as exploited. Patch Radar priority: High.
HighFixed on 3 platforms
CVSS
8.8
Important
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0032
24th percentile
<p>This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see <a href="https://chromereleases.googleblog.com/2026">Google Chrome Releases</a> for more information.</p>
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Google Chrome (EXE) | 156.0.8078.74 | Google Chrome (EXE) 156.0.8078.74 | Oct 27, 2026 |
| Google Chrome Beta (EXE) | 157.0.8103.6 | Google Chrome Beta (EXE) 157.0.8103.6 | Oct 15, 2026 |
| Google Chrome Dev (EXE) | 157.0.8081.0 | Google Chrome Dev (EXE) 157.0.8081.0 | Oct 1, 2026 |
| Microsoft Edge | 156.0.4314.56 | Microsoft Edge 156.0.4314.56 | Oct 29, 2026 |
| Microsoft Edge Beta | 157.0.4341.10 | Microsoft Edge Beta 157.0.4341.10 | Oct 20, 2026 |
| Microsoft Edge Dev | 157.0.4322.0 | Microsoft Edge Dev 157.0.4322.0 | Oct 6, 2026 |
| Microsoft Edge WebView2 Runtime | 156.0.4314.56 | Microsoft Edge WebView2 Runtime 156.0.4314.56 | Oct 29, 2026 |
| macOS | |||
| Google Chrome | 156.0.8078.74 | Google Chrome 156.0.8078.74 | Oct 26, 2026 |
| Microsoft Edge | 156.0.4314.56 | Microsoft Edge 156.0.4314.56 | Oct 28, 2026 |
| Linux | |||
| chromium · Debian 12.15 (bookworm) | 156.0.8078.73-1~deb12u1 | DEBIAN-CVE-2026-118317 | Oct 29, 2026 |
| chromium · Debian 13.5 (trixie) | 156.0.8078.73-1~deb13u1 | DEBIAN-CVE-2026-118317 | Oct 29, 2026 |
| chromium · Debian 14 | 156.0.8078.73-1 | DEBIAN-CVE-2026-118317 | Oct 29, 2026 |
| chromium · opensuse-leap 16.0 | 156.0.8078.73-bp160.1.1 | OPENSUSE-SU-2026:22202-1 | Nov 7, 2026 |