Google Chrome CVE-2026-118348

Exploitation requires a victim to load a crafted HTML page in a vulnerable Google Chrome build (prior to 156.0.8078.73) that reaches the Skia graphics component; the CVSS vector's UI:R confirms this user-interaction requirement and PR:N confirms no authentication is needed. It works against default Chrome configurations with no special feature toggle noted in the sources. The primary limiting factor is that, per the description, code execution is confined 'inside the sandbox' - so this flaw alone does not achieve host-level compromise and would require chaining with a separate sandbox-escape vulnerability. The specific malformed input that triggers the improper input validation is not described in the available sources.

This is a credible near-term patching priority but not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (visiting a crafted HTML page), with high confidentiality, integrity and availability impact and no scope change (S:U). Crucially, the NVD description states code execution occurs 'inside the sandbox' - meaning this bug alone does not yield full host compromise and would need to be chained with a separate sandbox-escape to be fully weaponized; this materially tempers the real-world severity implied by the 8.8 score. Chromium rates the security severity Critical, and the vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with a serious-but-chainable in-sandbox RCE. No EPSS score, no CISA KEV listing, and no SSVC decision content were provided, and no public exploit or PoC reference is present in the input, so exploitation likelihood cannot be quantified from the data given. The Skia graphics component is a common Chrome attack surface historically targeted in exploit chains, but that is context, not evidence of exploitation here. Net: patch promptly given ubiquitous deployment and critical in-sandbox RCE, while recognizing the sandbox boundary and absence of exploitation signals.

An attacker hosts or compromises a web page containing malformed graphics content that reaches the Skia rendering path; a victim running a vulnerable Chrome build visits the page, and the improper input validation is triggered to potentially execute attacker-controlled code within the renderer sandbox. Exploitation requires user interaction (loading the page) but no authentication. No public exploit code or PoC reference is identified in the available data.