CVE and update status of the FreeBSD ports tree3,597 unaddressed CVEs in 720 portsAll times are CET
CVE details

CVE-2026-118347

Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Score
8.8 high
Published
2026-10-27
Links
NVD · cve.org · Report wrong data

Matched ports (2)

PortPackageVersionStatusMaintainer
www/chromiumchromium156.0.8078.47_1unaddressedchromium@FreeBSD.org
www/linux-chromelinux-chrome156.0.8078.47unaddressedemulation@FreeBSD.org

Template for a VuXML entry

This generator is not reliable at the moment

Package names, ranges and the XML itself can be wrong. Always check the content before you commit it, and run make validate in security/vuxml. The generator is being rewritten from scratch.

Range per package from the CVE record, for ports with a version line in their name (python312) only from that line. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>chromium</name>
	<range><lt>156.0.8078.73</lt></range>
      </package>
      <package>
	<name>linux-chrome</name>
	<!-- 156.0.8078.73 is not released yet, newest upstream is 154.0.8037.92 -->
	<range><lt>156.0.8078.73</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Use after free in FileSystem in Google Chrome prior to 156.0.8078.73
	  allowed a remote attacker to execute arbitrary code inside the sandbox
	  via a crafted HTML page. (Chromium security severity: High)</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-118347</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-118347</url>
    </references>
    <dates>
      <discovery>2026-10-27</discovery>
      <entry>2026-10-28</entry>
    </dates>
  </vuln>