Google Chrome CVE-2026-118306

Exploitation requires a victim using a vulnerable Google Chrome desktop build (prior to 156.0.8078.73) to render attacker-controlled content - the CVSS UI:R and the description ('via a crafted HTML page') mean the user must open or be navigated to a malicious page; it is not self-propagating or zero-click. No authentication is required (PR:N / remote unauthenticated attacker). The limiting factors are this required user interaction and the need for the target to be on an unpatched Chrome version; successful code execution outside the sandbox (S:C) is what makes impact severe, but the specific configuration or FileSystem interaction needed to trigger the corruption is not described in the available sources. Updating to 156.0.8078.73 or later is the fix stated by the vendor.

Signals conflict in a way that still favors prioritization. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6 Critical) describes a network-reachable, unauthenticated flaw requiring only that a victim open a crafted page, with a scope change reflecting the sandbox escape - consistent with the description of code execution outside the Chromium sandbox. Against that, the EPSS score is low (0.24%, 15th percentile), and the CVE is NOT listed in CISA KEV, and no public exploit is identified in the provided data. The vuln.today decision label is act_now, which - combined with Chrome's ubiquity and Google's own 'Critical' severity rating for a sandbox-escape RCE - is the dominant driver here: this is a genuine priority despite the low EPSS, because EPSS reflects observed/predicted mass exploitation rather than the intrinsic danger of a browser sandbox escape, and freshly-patched Chrome bugs routinely attract exploitation after disclosure. The low EPSS and absence from KEV indicate it is not (yet) known to be exploited at scale, not that risk is low. Treat this as patch-now based on act_now, scope-changed Critical RCE, and near-universal deployment; do not be reassured by the EPSS percentile.

An attacker hosts or compromises a web page containing crafted HTML that triggers the FileSystem memory-corruption bug when rendered by a vulnerable Chrome build (prior to 156.0.8078.73). A victim who simply visits the page can have attacker-controlled code executed outside the browser sandbox, with no authentication required beyond the user opening the page. No public exploit code is identified at time of analysis, and the precise trigger is not described in the available sources.