Google Chrome CVE-2026-118335

Exploitation requires the victim to open a crafted HTML page in Google Chrome on macOS prior to 156.0.8078.73 (UI:R, PR:N - remote, unauthenticated, but user interaction such as visiting a page is mandatory). The flaw is in the Metrics component and is reachable against default configurations with no special feature toggle noted in the sources. Key limiting factors: it affects the Mac build specifically, requires user interaction to load attacker content, and the resulting code execution is confined to the renderer sandbox (scope Unchanged) - full host compromise would require an additional, separate sandbox-escape vulnerability not described here.

This is a genuine but moderate-urgency priority rather than a drop-everything emergency, and the signals are mostly consistent. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity, unauthenticated flaw needing only user interaction, which matches the description of remote code execution triggered by a crafted HTML page. Chromium rated the security severity 'High', and the vuln.today decision label is 'this_week', which aligns with a serious-but-not-actively-exploited browser bug. Crucially, the description states code execution occurs 'inside the sandbox' and the CVSS scope is Unchanged (S:U), meaning this is renderer-level code execution confined to Chrome's sandbox rather than a full host compromise - an attacker would still need a separate sandbox-escape chain to reach the underlying macOS system, which materially tempers real-world impact. No EPSS score, no CISA KEV listing, and no confirmed public exploit were provided in the input, so there is no evidence of active exploitation or weaponization; the absence of these signals should be read as 'not reported' rather than 'confirmed safe'. The chromium.org issue link is a bug-tracker reference (typically access-restricted), not a verified working exploit.

An attacker hosts or injects a malicious web page and lures a macOS Chrome user (via a link, ad, or compromised site) to open it. The crafted HTML triggers the improper input validation in the Metrics component, allowing the attacker to execute arbitrary code within the renderer sandbox; a separate sandbox escape would be required to break out to the host. No public exploit code was identified in the provided data.