Google Chrome CVE-2026-118320

Exploitation requires a victim running a vulnerable Google Chrome desktop build (prior to 156.0.8078.73) to load attacker-controlled content - the CVSS UI:R and the description's 'crafted HTML page' confirm user interaction (navigating to or rendering a malicious page) is mandatory; no authentication is required (PR:N) and no non-default configuration is needed. The key limiting factor is containment: the description explicitly states code execution is 'inside the sandbox' (renderer process), so full host compromise additionally requires chaining a separate sandbox-escape vulnerability. No special product feature or configuration toggle is called out as a prerequisite.

This is a credible near-term priority but not a drop-everything emergency, consistent with the vuln.today Decision label of 'this_week'. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U, score 8.8) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction (visiting a crafted page), which matches the description's 'crafted HTML page' trigger. The single most important nuance is that the description states code execution occurs 'inside the sandbox' - i.e. within the renderer process - so by itself this does NOT yield full host compromise without being chained to a separate sandbox-escape bug; the Scope:Unchanged in the vector is consistent with that containment. No EPSS score, no CISA KEV entry, and no confirmed public exploit were supplied in the input, so there is no signal of active or widespread exploitation at time of analysis; Chromium itself rated the severity 'High' rather than 'Critical'. Net: because the affected product (Chrome/V8) is ubiquitous and historically a heavy target for exploit chains, prompt patching is warranted, but the absence of KEV/EPSS/POC signals means this currently reads as a high-CVSS, patch-promptly issue rather than a confirmed in-the-wild threat. Missing data to note: EPSS probability and POC status were not provided, and the chromium issue tracker link is almost certainly access-restricted, so exploit maturity cannot be independently confirmed here.

An attacker hosts or compromises a web page containing malicious JavaScript/HTML that triggers the V8 memory-corruption bug when a victim using a vulnerable Chrome build loads it. Successful exploitation lets the attacker run arbitrary code inside the renderer sandbox; to escape to the underlying OS the attacker would need to chain a separate sandbox-escape vulnerability. No public exploit code was identified in the provided data.