Google Chrome CVE-2026-118329

Exploitation requires a victim running Google Chrome on macOS at a version prior to 156.0.8078.73 to open an attacker-controlled or compromised web page containing crafted HTML that reaches the ANGLE graphics component (UI:R). No authentication or prior privileges are needed (PR:N). Limiting factors: the flaw is macOS-specific (Windows and Linux builds are not indicated as affected), it requires user interaction to load the malicious page, and the resulting code execution is confined to the renderer sandbox per the description - achieving host compromise would require chaining a separate sandbox-escape vulnerability.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw needing no privileges but requiring user interaction (visiting a page). Google rates the Chromium severity High. The vuln.today Decision label is 'this_week', indicating an elevated-but-not-emergency priority consistent with a patch already being available. No EPSS score, no CISA KEV listing, and no confirmed public exploit were provided; one reference points to the Chromium issue tracker (issues.chromium.org/568900535), which is a bug-tracker entry that is typically access-restricted and is not verified as working exploit code. A key mitigating nuance the CVSS score does not capture: the description states code executes 'inside the sandbox,' so this is constrained renderer-level code execution rather than a full sandbox escape or host compromise, which lowers real-world impact unless chained with a separate sandbox-escape bug. This is a legitimate patch-promptly issue given Chrome's reach and the available fix, but absent KEV/EPSS/PoC signals there is no evidence of active or imminent widespread exploitation; it reads as a standard high-severity browser bug to remediate on the normal fast cadence rather than an emergency.

An attacker hosts or compromises a web page containing crafted HTML that feeds malformed input to Chrome's ANGLE graphics layer on macOS; when a victim running a vulnerable Chrome build visits it, the improper input validation is triggered and the attacker can potentially execute arbitrary code within the renderer sandbox. No authentication is required (PR:N), but the victim must open the page (UI:R), and low attack complexity (AC:L) means no special timing or environmental conditions are described. No public exploit was identified at time of analysis.