Google Chrome CVE-2026-118339

Exploitation requires the victim to use an affected Google Chrome build (prior to 156.0.8078.73) and to load a crafted HTML page under attacker control - this user interaction (UI:R) is the primary limiting factor; no authentication or special privileges are needed (PR:N). No non-default configuration is indicated: default Chrome installs are vulnerable when rendering the malicious content. The decisive additional limit is the sandbox boundary: the description states code executes 'inside the sandbox', so standalone exploitation yields only renderer-process execution and a separate sandbox-escape vulnerability would be needed to reach the host OS. The specific memory-layout or timing conditions needed to win the use-after-free are not described in the available sources.

This is a genuine, high-priority vulnerability but not an active-exploitation emergency based on the data provided. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw whose only meaningful barrier is user interaction - the victim must load attacker-controlled web content - which is a trivial condition for a browser. CWE-416 use-after-free in the Animation component combined with C:H/I:H/A:H yields the 8.8 (High) score, and Google's own 'High' Chromium severity rating is consistent. The vuln.today decision label is 'this_week', indicating prompt but not emergency remediation. Crucially, the input provides NO EPSS score, NO CISA KEV listing, and NO confirmed PoC/exploit - so there is no signal of active or widespread exploitation at this time; SSVC-style automatable/exploitation fields are also absent. The description explicitly states code execution is 'inside the sandbox', which materially limits impact: a successful attacker gains execution within the restricted renderer process and would still need a separate sandbox-escape chain to compromise the host, so the C/I/A:H values reflect renderer-context impact rather than full system takeover. Net: patch on a normal expedited cycle; this is a real priority, not merely a high-CVSS-low-real-risk issue, but current evidence does not elevate it to drop-everything status.

An attacker hosts or injects a crafted HTML page containing JavaScript that manipulates the Animation subsystem to trigger a use-after-free, then lures a Chrome user (via a link, ad, or compromised site) into visiting it. Dangling-pointer reuse lets the attacker corrupt memory and execute arbitrary code within the renderer sandbox. No public exploit code is identified in the provided data, and full host compromise would require chaining an additional sandbox escape.