Google Chrome CVE-2026-118340

Exploitation requires a victim running Google Chrome before 156.0.8078.73 to load attacker-controlled content - the CVSS UI:R and the description's 'via a crafted HTML page' confirm user interaction (visiting or being served a malicious page) is the gating condition; no authentication is required (PR:N) and default configurations are affected. The scope change (S:C) and 'outside the sandbox' wording indicate successful exploitation breaks out of Chrome's renderer sandbox to the host. The principal limiting factor is the required user interaction (loading the crafted page) and the version boundary: patched builds (156.0.8078.73 and later) are not affected. The exact memory-corruption trigger inside Skia is not detailed in the available sources.

Signals mostly align toward high priority but with one notable tension. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6 Critical) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page, with a scope change reflecting that code executes outside the Chrome sandbox - i.e. a full renderer-to-host compromise. The vuln.today Decision label is act_now and a vendor patch is available, reinforcing urgency. However, the EPSS score is only 0.22% (13th percentile) and the vulnerability is NOT listed in CISA KEV, so there is no public evidence of active exploitation; the input shows no verified exploit code either. The act_now label therefore appears driven by the vulnerability's intrinsic severity (unauthenticated sandbox-escape RCE in a ubiquitous browser) and patch availability rather than by observed exploitation. This is a genuine priority for patch deployment, but defenders should read it as 'pre-emptive, patch-now' rather than 'under mass exploitation': the low EPSS and absent KEV listing indicate no confirmed widespread exploitation at time of analysis. No SSVC component values (automatable, technical impact) were supplied beyond the aggregate act_now label.

An attacker hosts or compromises a web page containing malformed graphics content that triggers the memory-corruption flaw in Chrome's Skia rendering engine. When a victim using a pre-156.0.8078.73 build simply visits the page, the corruption is leveraged to execute arbitrary code outside the browser sandbox on the host. No public, verified exploit code is identified in the provided data, so this scenario is inferred from the CVSS vector and description.