Google Chrome CVE-2026-118309

Exploitation requires a user of an unpatched Google Chrome on Android (versions prior to 156.0.8078.73) to open a crafted HTML page; the CVSS UI:R and the description's 'crafted HTML page' make victim interaction (loading the page) the mandatory precondition. No authentication or elevated privileges are needed (PR:N), and attack complexity is low (AC:L), so no special configuration is required beyond running a vulnerable version. The limiting factors are that the attacker cannot act without the user visiting the malicious page and that patched builds (>=156.0.8078.73) are not affected; the precise input that triggers the UI validation failure is not described in the available sources.

Raw severity is critical: CVSS 3.1 scores 9.6 with AV:N/AC:L/PR:N/UI:R/S:C and full C:H/I:H/A:H, reflecting a network-reachable, unauthenticated sandbox escape that only requires the victim to open a crafted page. However, the signals conflict on urgency drivers: EPSS is just 0.22% (13th percentile), there is no CISA KEV listing, and no public exploit is referenced - so there is no public exploit identified at time of analysis. Against that, the vuln.today Decision label is act_now and the vendor rated the Chromium severity High, which for the Chrome update cadence means patch-now rather than wait. The practical read: this is a genuine high priority to patch because of impact (sandbox escape → arbitrary code) and the ease of mass delivery via web pages, but the low EPSS and absence of KEV/POC indicate exploitation is not currently observed or widespread - the main limiting factor is the UI:R requirement that a user must load the attacker's page. Note a source inconsistency: the description states Android while the only vendor reference points to a 'stable-channel-update-for-desktop' blog, so the affected-platform detail should be confirmed against the vendor advisory.

A remote attacker hosts or injects a crafted HTML page and lures an Android Chrome user to open it (UI:R); because AC:L and PR:N, no special timing or authentication is needed once the page loads. Exploiting the improper input validation in the UI, the attacker breaks out of the renderer sandbox (S:C) to potentially execute arbitrary code on the device. No public exploit is identified at time of analysis.