CVE-2026-118338: Use‑After‑Free in Chromium Animation Affects Edge Users

What happened

A recently disclosed vulnerability, CVE-2026-118338, exploits a use‑after‑free condition in the animation subsystem of Chromium. The flaw arises when the engine processes a malformed animation sequence, freeing memory that is still referenced by other parts of the rendering pipeline. An attacker can trigger this by delivering a specially crafted animation file or embedding malicious code within a web page that the browser renders.

The issue was identified by the Chromium project and assigned a CVE identifier. It was subsequently reported to Microsoft as part of the shared Chromium codebase that powers Microsoft Edge. The vulnerability is classified with a CVSS score of 9.8, indicating a high likelihood of exploitation and severe impact.

Who is affected

All users of Microsoft Edge (Chromium‑based) versions 120 and earlier are susceptible to this flaw. The same applies to Google Chrome versions 120 and earlier, as the underlying code is identical. Enterprise deployments that have not applied the latest security patches or that rely on older browser versions remain at risk.

Additionally, any systems that use Chromium‑based components for embedded web rendering—such as Electron applications, Chrome‑based browsers on Linux distributions, or other third‑party software—could be indirectly affected if they ship with an unpatched Chromium engine.

Impact

The use‑after‑free can lead to arbitrary code execution in the context of the browser process. An attacker who successfully exploits the flaw can run native code, potentially escalating privileges or installing malware. Because the vulnerability is triggered by rendering content, it can be abused in drive‑by‑download scenarios, making it a high‑risk vector for phishing and malicious websites.

In addition to code execution, the flaw may allow attackers to crash the browser, leading to denial‑of‑service conditions that could disrupt user productivity or compromise the stability of web‑based services.

Exposure

Exploitation requires the victim to visit a malicious web page or open a crafted animation file. The attacker can embed the exploit within a legitimate website or deliver it via email attachments that trigger the browser’s rendering engine. Because the flaw resides in a core rendering component, it can be triggered without user interaction beyond normal browsing.

Defenders should be aware that the vulnerability can be leveraged in cross‑site scripting (XSS) or cross‑origin resource sharing (CORS) attacks, where an attacker injects malicious animation data into a trusted site’s content. This increases the attack surface for compromised or malicious sites.

What to do

Update immediately to the latest Microsoft Edge or Google Chrome release. Microsoft Edge 121 and Chrome 121 contain the patch that removes the vulnerable code path and adds additional bounds checking. For enterprise environments, use the Windows Update catalog or group policy to enforce automatic updates.

As a temporary mitigation, disable animations via the browser flags or group policy settings. In Edge, navigate to edge://flags and set "Enable animations" to "Disabled". In Chrome, use the "Disable animations" policy under the Chrome Enterprise policy templates. This reduces the attack surface until a full patch is applied.

What to watch

Monitor threat intelligence feeds for reports of active exploitation attempts targeting CVE-2026-118338. Look for indicators such as unusual network traffic to known malicious domains or anomalous process creation events that match the signature of the exploit payload.

Stay alert for zero‑day variants that may bypass the current patch, especially in environments that use older Chromium versions for legacy applications. Regularly review the Microsoft Security Response Center and the Chromium project’s release notes for any new mitigations or updates related to this CVE.