Google Chrome CVE-2026-118305

Exploitation requires the victim to load an attacker-controlled crafted HTML page in a vulnerable Google Chrome build prior to 156.0.8078.73 (UI:R); this user interaction is the primary limiting factor. No authentication and no special privileges are required (PR:N), and exploitation works against default configurations with no special feature or setting named in the description. The flaw resides in the Turbolev component, and success yields code execution outside the Chrome sandbox (scope change). The sole complete fix per the vendor is updating to 156.0.8078.73 or later.

Signals are mixed but lean toward high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6 Critical) describes a remote, unauthenticated, low-complexity flaw that requires user interaction, with a scope change reflecting the stated sandbox escape - arbitrary code execution reaches beyond the renderer to the host. The vuln.today decision label is act_now and a vendor patch is available, which argues for prompt remediation. Counterbalancing this, the EPSS probability is low at 0.24% (15th percentile), indicating that mass exploitation is not currently predicted. There is no CISA KEV listing in the input, so there is no confirmed active exploitation, and no public exploit was identified at time of analysis (the Chromium issue tracker reference is a restricted bug entry, not exploit code). The low EPSS alongside an act_now label reflects a freshly patched browser RCE with sandbox escape where tooling has not yet matured rather than a low-real-risk, high-CVSS artifact. No contradictions between the vector and description were found: the description's 'crafted HTML page' is consistent with AV:N/UI:R, and 'outside the sandbox' is consistent with S:C.

An attacker hosts a malicious web page or injects crafted HTML into a compromised/ad-served context and lures a victim running a vulnerable Chrome build to visit it. Rendering the page triggers memory corruption in the Turbolev component, which the attacker leverages to execute arbitrary code outside the browser sandbox on the victim's host. Exploitation requires the victim to load attacker-controlled content (UI:R), but no authentication; no public exploit was identified at time of analysis.