Google Chrome CVE-2026-118332

Exploitation requires a victim using Google Chrome prior to 156.0.8078.73 to load a crafted HTML page controlled by the attacker; this is the user-interaction prerequisite reflected by UI:R. No authentication and no special Chrome configuration are indicated - the flaw is reachable in default rendering of web content via the Compositing component. The principal limiting factor is that the attacker cannot act purely remotely: the target must be induced to visit or open the malicious page (e.g. via phishing, malvertising, or a compromised site). The payoff, per the description, is code execution outside the sandbox, so a successful trigger crosses the renderer's security boundary to the host.

Signals conflict in a way that still favors prompt action. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C with C:H/I:H/A:H, score 9.6) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction, and the scope change (S:C) plus the description's phrase 'execute arbitrary code outside the sandbox' indicate a renderer-to-host sandbox escape - the most serious outcome class for a browser. Against that, the EPSS score is only 0.21% (11th percentile), i.e. low modeled probability of exploitation in the near term, and there is no CISA KEV listing and no public exploit reference in the supplied data, so this is currently a high-severity flaw without confirmed active exploitation. The vuln.today decision label is act_now, which is the authoritative urgency signal here and aligns with the sandbox-escape impact and the fact that a vendor patch already exists; the low EPSS reflects that no exploitation has been observed yet, not that the issue is low-priority. No SSVC decision vector (exploitation/automatable/technical-impact) was supplied, so that framework cannot be independently applied beyond the act_now label. Net: treat as a real high priority to patch, driven by impact (sandbox escape, triple-high CIA, network vector) and the act_now label, while recognizing exploitation is not confirmed and EPSS is currently low.

An attacker hosts or compromises a web page containing crafted content that triggers the improper input validation in Chrome's Compositing component when the victim's browser renders it. If the victim visits the page, the flaw can be leveraged to execute arbitrary code outside the renderer sandbox on the victim's machine. No authentication is required, but the victim must load the malicious page; no public exploit code is identified in the available data.