Google Chrome CVE-2026-118321

Exploitation requires the victim to open a crafted HTML page in a vulnerable Chrome build (prior to 156.0.8078.73), per UI:R in the CVSS vector - there is no fully passive/zero-click path described. No authentication, special privileges, or non-default configuration is needed (PR:N), so any user browsing to attacker-controlled content on an unpatched installation is exposed. The principal limiting factors are the required user interaction (visiting/loading the page) and the version boundary: installations at or above 156.0.8078.73 are fixed. The trigger mechanism within the 'Core' component is not detailed in the available sources beyond 'improper input validation' leading to code execution outside the sandbox.

Severity signals are strongly concordant on paper: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated flaw that only needs the victim to load a page, and the scope change (S:C) plus the description's phrase 'execute arbitrary code outside the sandbox' indicate a sandbox escape - the most dangerous class of browser bug. The vuln.today Decision label is act_now and a vendor patch is available, so the operational guidance is to update immediately. However, the exploitation-likelihood signals are low and not corroborating: EPSS is only 0.22% (13th percentile), there is no CISA KEV listing, and no confirmed public exploit code - consistent with a freshly disclosed, patched Chromium High-severity bug that has not yet been weaponized publicly. The practical read: this is a high-priority patch-now item because of impact and ease of triggering, not because active mass exploitation is observed. Note a data inconsistency to verify: the description says 'Google Chrome on Android' while the primary vendor reference is the desktop Stable channel update blog post and the EUVD version string is malformed ('Chrome 156.0.8078.73 <156.0.8078.73') - confirm the affected platform (Android vs. desktop) and fixed build with the Chrome release notes.

An attacker hosts or compromises a web page containing crafted HTML that triggers the improper input validation flaw in a Chrome Core component; when a victim visits it, the attacker gains code execution that escapes the renderer sandbox. No authentication is required, but the victim must open the malicious page (UI:R). No public exploit code has been identified at time of analysis.