Google Chrome CVE-2026-118328

Exploitation requires the victim to open an attacker-controlled HTML page that exercises Chrome's WebRTC stack (UI:R) on a Chrome build prior to 156.0.8078.73; no authentication or special privileges are needed (PR:N). Limiting factors: the required user interaction (loading the malicious page), and that resulting code execution is explicitly described as occurring inside the renderer sandbox - full host compromise would require an additional sandbox escape not described in this CVE. The available sources do not detail the exact malformed WebRTC input needed to trigger the flaw; the trigger mechanism beyond 'crafted HTML page' is not described in the available sources.

This is a genuine high-priority browser flaw but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity bug needing no privileges but requiring user interaction - the victim must open a crafted HTML page. Google rated the Chromium severity High and a vendor patch is available. The vuln.today decision label is 'this_week', signaling prompt but not immediate action. Key signals are MISSING rather than conflicting: no EPSS exploitation-probability score is provided, the CVE is NOT listed in CISA KEV, and no public exploit or PoC reference is present (the issues.chromium.org link is a restricted vendor bug tracker, not exploit code). Importantly, the description states code execution occurs 'inside the sandbox' - Chrome's renderer sandbox normally contains such execution, so on its own this does not yield full host compromise without a separate sandbox-escape chain; the C:H/I:H/A:H impact should be read in that sandboxed context. Net: a real patch-this-week issue for a ubiquitous product, not a drop-everything zero-day given no evidence of active exploitation.

An attacker hosts or injects a malicious HTML page that drives WebRTC with crafted input to trigger the improper input validation flaw; when a victim visits the page, the attacker achieves arbitrary code execution confined to Chrome's renderer sandbox. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) is offset by the required user interaction (UI:R) of visiting the page.