Chromium CVE-2026-118306: Memory Corruption in FileSystem Affects Chromium‑Based Browsers

What happened

A defect was discovered in the FileSystem component of Chromium that allows a memory corruption condition to be triggered when processing certain file system operations. The flaw can be exploited by an attacker who can supply crafted input to the browser, potentially leading to arbitrary code execution within the browser process.

The vulnerability was assigned by Google and subsequently incorporated into the Chromium code base. Microsoft Edge, which is built on Chromium, inherits this flaw until the next patch cycle addresses it.

Who is affected

All users of Chromium‑based browsers that have not applied the latest security updates are at risk. This includes Microsoft Edge, Google Chrome, and any other distribution that bundles the Chromium engine without the specific patch for CVE‑2026‑118306.

Enterprise environments that rely on legacy or pinned browser versions are especially vulnerable, as they may not receive the automatic updates that deliver the fix.

Impact

When successfully exploited, the memory corruption can allow an attacker to execute arbitrary code with the privileges of the browser process. This can lead to credential theft, session hijacking, or the execution of further malware within the user’s session.

Because the flaw resides in the core file system handling, it can be triggered by a malicious web page or a compromised local file, expanding the attack surface beyond typical web‑based vectors.

Exposure

Attackers can trigger the vulnerability through crafted URLs, malicious web content, or by manipulating local file system requests that the browser processes. The flaw does not require privileged access; it can be executed in a standard user context.

Once the memory corruption occurs, the attacker may gain control over the browser process, enabling further lateral movement or persistence mechanisms if the user is running privileged applications that interact with the browser.

What to do

• Verify that Microsoft Edge and other Chromium‑based browsers are updated to the latest stable release. The patch for CVE‑2026‑118306 is included in the most recent security update.
• For environments that cannot immediately update, disable the FileSystem API for untrusted content by applying group policy or registry changes that restrict file system access from web pages.
• Enable browser sandboxing features and enforce the principle of least privilege for browser processes.
• Deploy endpoint detection and response (EDR) solutions that monitor for anomalous memory access patterns or unexpected process behavior associated with browser activity.

What to watch

• Unusual outbound connections originating from the browser process, especially to known malicious IP addresses.
• Repeated crashes or hangs in the browser that could indicate memory corruption attempts.
• Unexpected changes to browser configuration files or extensions that may have been installed without user consent.
• Indicators of compromise reported by threat intelligence feeds that mention CVE‑2026‑118306 or related exploitation techniques.