Chromium CVE-2026-118347 Use‑After‑Free in FileSystem – Edge and Chromium Users Must Update

What happened

A recent analysis uncovered a use‑after‑free vulnerability in Chromium’s FileSystem module, identified as CVE‑2026‑118347. The flaw arises when the FileSystem API frees memory prematurely while other operations still reference the same buffer. Attackers can exploit this to corrupt memory and potentially execute arbitrary code in the context of the browser process.

The issue was first reported to Google and subsequently incorporated into the Chromium codebase. Microsoft Edge, built on the same Chromium engine, inherits the vulnerability until the next security update is applied. No public exploit has been observed in the wild yet, but the severity rating is high due to the potential for privilege escalation within the browser sandbox.

Who is affected

All users running Microsoft Edge (Chromium‑based) versions that include the vulnerable FileSystem implementation are at risk. This includes Windows 10, Windows 11, and any other operating systems that ship Edge with the affected Chromium build. The vulnerability also impacts any custom applications that embed Chromium or use the Edge WebView2 control without updating to a patched version.

Organizations that deploy Edge for internal web browsing, web‑based applications, or remote desktop solutions should review their deployment inventory. The flaw is present in any build that predates the security patch released in the latest Edge update cycle.

Impact

When triggered, the use‑after‑free can corrupt heap memory, leading to unpredictable behavior. In a sandboxed environment, this may allow an attacker to escape the browser sandbox and gain elevated privileges on the host system. The impact is therefore significant for both end‑users and enterprise environments where Edge is used for sensitive tasks.

Because the vulnerability is triggered through the FileSystem API, malicious web pages or scripts that gain user interaction can serve as the attack vector. Phishing sites or compromised legitimate sites could embed exploit code that targets the flaw, potentially compromising the user’s machine without additional user action beyond visiting the site.

Exposure

The flaw is exploitable via standard web content that interacts with the FileSystem API. Attackers can craft a malicious web page that performs a sequence of file operations designed to trigger the use‑after‑free. The vulnerability does not require elevated privileges or additional software; it is purely a browser‑level issue.

Because the vulnerability is tied to the browser’s internal memory management, it is not limited to a specific platform. Both Windows and Linux builds of Edge are affected if they use the unpatched Chromium engine. The risk is therefore global across all platforms that ship the vulnerable build.

What to do

• Verify the Edge version on all endpoints. The vulnerability is fixed in Edge 125.0.6420.0 and later.
• Deploy the latest Microsoft Edge update through Windows Update, Intune, SCCM, or your preferred software distribution tool.
• For applications using Edge WebView2, update the WebView2 runtime to the latest version (≥ 125.0.6420.0).
• Conduct a quick audit of any custom Chromium‑based browsers or embedded controls to ensure they reference the patched engine.
• Implement web filtering to block known malicious domains that may host exploit code targeting the FileSystem API.
• Enable browser sandboxing and restrict file system access for web pages via group policy or enterprise policy settings.

What to watch

Security researchers are monitoring for any active exploitation attempts. Look for anomalous memory corruption errors in browser logs or unexpected process crashes that could indicate a use‑after‑free exploit. Pay attention to new advisories from Microsoft and Google regarding Chromium vulnerabilities.

Keep an eye on the Microsoft Security Response Center (MSRC) and the Chromium project’s release notes for any additional mitigations or patches. If you discover any signs of exploitation, isolate the affected systems immediately and apply the latest security updates.