Google Chrome CVE-2026-118347

Exploitation requires the victim to load attacker-controlled content in Google Chrome desktop prior to 156.0.8078.73 - a crafted HTML page that drives the FileSystem component into a use-after-free (UI:R in the vector reflects this required user interaction). No authentication and no non-default configuration are needed (PR:N; default Chrome install is affected). The principal limiting factor is that code execution is explicitly confined to the Chrome renderer sandbox: without a separate sandbox-escape vulnerability, the attacker does not gain execution on the host OS. The exact object-lifetime trigger is not detailed in the available sources.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a remotely reachable, low-complexity, unauthenticated memory-corruption flaw whose only gating factor is user interaction - the victim must load a crafted page. However, the description explicitly states code executes 'inside the sandbox,' which materially lowers real-world impact: successful exploitation yields control of the Chrome renderer process only, and full host compromise would require a separate sandbox-escape chain that is not covered by this CVE. The vuln.today priority is 'this_week' (not act_now/emergency), consistent with a serious browser RCE that should be patched promptly but is not flagged for immediate emergency action. No EPSS score, no CISA KEV listing, and no confirmed public exploit were provided, so there is no signal of active or widespread exploitation at this time. Net: a genuinely high-severity browser bug warranting prompt patching, but the sandbox-confinement caveat and the absence of KEV/EPSS/PoC evidence argue against treating it as an in-the-wild emergency. Note the Chromium-assigned severity is 'High,' not 'Critical,' which aligns with sandboxed-RCE rather than a full remote takeover.

An attacker hosts or injects a malicious HTML page that drives the Chrome FileSystem component into a use-after-free state; when a victim running an unpatched Chrome (prior to 156.0.8078.73) visits the page, the freed object is reused to achieve arbitrary code execution within the renderer sandbox. Because the CVSS vector requires user interaction (UI:R), the attacker must lure the victim to the page (e.g., via a link or malvertising). No public exploit code was identified in the provided data, and the resulting execution is confined to the sandbox absent a further escape.