Google Chrome CVE-2026-118316

Exploitation requires the victim to be running Google Chrome prior to 156.0.8078.73 and to visit or load an attacker-controlled crafted HTML page that is processed by the V8 engine; no authentication is needed (PR:N) and default configurations are affected. The principal limiting factor is the required user interaction (UI:R) - the victim must navigate to or render the malicious page - which rules out fully autonomous/wormable network exploitation and makes delivery dependent on phishing, malvertising, or a compromised/attacker-hosted site. Because the impact is a full sandbox escape to arbitrary code execution on the host (S:C), successful exploitation yields host-level compromise rather than mere in-browser effects.

Signals point in two directions and must be weighed together. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C with C:H/I:H/A:H, base 9.6) describes a remotely reachable, low-complexity, unauthenticated flaw whose scope change (S:C) is corroborated by the description's explicit claim of code execution 'outside the sandbox' - a V8 renderer compromise that breaks the Chromium sandbox boundary, which is the high-impact case. Against that severity, the exploitation-likelihood signals are modest: EPSS is only 0.21% (11th percentile), there is no CISA KEV listing in the input, and no public exploit or PoC reference is provided. The vuln.today Decision label is act_now, which - combined with the sandbox-escape RCE and the fact that a patch is already shipping - reflects urgency driven by severity and patch-availability rather than by observed mass exploitation. These signals are not contradictory so much as describing different things: the vulnerability is genuinely dangerous if exploited, but there is no evidence in the provided data that exploitation is currently widespread. The low EPSS despite the act_now label indicates a high-priority patch item on the strength of impact and attacker value (V8 RCE in a ubiquitous browser), not confirmed in-the-wild activity. Chromium's own rating is 'High', not 'Critical', consistent with the UI:R requirement tempering real-world ease of attack.

An attacker hosts or injects a crafted HTML page that drives Google Chrome's V8 JavaScript engine into an improper-input-validation condition; when a victim running a version prior to 156.0.8078.73 navigates to the page, the flaw is triggered and leads to arbitrary code execution outside the renderer sandbox on the victim's host. User interaction (visiting the page) is required, so delivery typically relies on phishing, malvertising, or a compromised site. No public exploit code or PoC reference is identified in the available data.