Chromium CVE-2026-118352: Memory Corruption in Cache – Edge and Chrome Impact

What happened

Chromium introduced a memory corruption bug in its cache subsystem, identified as CVE-2026-118352. The flaw arises when malformed cache entries are parsed, potentially overwriting adjacent memory and allowing an attacker to inject arbitrary code during normal browsing operations.

Because Microsoft Edge is built on the Chromium engine, the same vulnerability propagates to all Chromium‑based browsers that have not yet applied the patch. The issue is not limited to a single browser version; it exists in every release that includes the affected cache handling logic.

Who is affected

All users of Microsoft Edge, Google Chrome, and any other Chromium‑derived browsers that have not updated to the latest release are potentially vulnerable. This includes enterprise deployments where browsers are pinned to older versions for compatibility reasons.

Defenders managing Windows, macOS, Linux, and mobile platforms must consider that the vulnerability can be triggered from any web page or malicious extension that can deliver a crafted cache entry.

Impact

The memory corruption can lead to arbitrary code execution with the privileges of the browser process. In a compromised environment, this could provide a foothold for lateral movement, credential theft, or execution of malicious payloads.

Because the flaw is triggered by cache parsing, it can be exploited without user interaction beyond visiting a malicious site or loading a compromised extension. The impact is therefore broad and can affect both individual users and large enterprise networks.

Exposure

Attackers can embed malicious cache entries in HTTP responses or through malicious extensions. Once the browser processes the entry, the corrupted memory region can be leveraged to execute attacker‑controlled code. The attack surface is therefore the set of all web traffic and extensions that the browser accepts.

Defenders should be aware that the vulnerability can be exploited in both inbound and outbound contexts: a compromised browser can be used to exfiltrate data or to pivot to other systems.

What to do

• Verify the current browser version on all endpoints. Edge 118+ and Chrome 118+ include the patch; earlier versions require an update.
• Deploy the latest security update through your standard patch management system. For Windows, use WSUS or SCCM; for macOS, use the Software Update service; for Linux, use the distribution’s package manager.
• Force browsers to use the latest version by disabling automatic updates in environments where updates are manually controlled, and schedule a forced update cycle.
• Implement a web‑filtering solution that blocks known malicious domains and detects anomalous cache traffic patterns.
• Enable application whitelisting to prevent unauthorized extensions from installing or executing.
• Monitor endpoint logs for signs of memory corruption or abnormal process behavior, such as sudden crashes or unexpected network connections.

What to watch

• New exploit code that leverages the cache corruption to bypass sandboxing or to elevate privileges.
• Malicious extensions that attempt to inject crafted cache entries into the browser’s cache.
• Indicators of compromise such as unusual DNS queries or traffic to obscure IP addresses that may be used to deliver malicious cache payloads.
• Any changes in the behavior of the browser, such as repeated crashes or unexpected redirects, which could signal exploitation attempts.