Google Chrome CVE-2026-118349

Exploitation requires the victim to visit or open an attacker-crafted HTML page in Google Chrome at a version prior to 156.0.8078.73; the flaw is in the Payments component. Per CVSS PR:N the attacker needs no authentication, but UI:R means the attack cannot succeed without user interaction (navigating to the malicious page), which is the primary limiting factor. A further material limit is that the description scopes code execution to 'inside the sandbox,' so this alone yields only renderer-process compromise - gaining control of the underlying host would additionally require a separate sandbox-escape vulnerability. Users on patched builds (156.0.8078.73 or later) are not affected.

Signals point to a genuine but not top-tier emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a remote, low-complexity, unauthenticated flaw that requires user interaction - the victim must load a crafted HTML page. Chromium rates the security severity as High, and the vuln.today decision label is 'this_week', not 'act_now'/'emergency', which aligns with a serious browser RCE that is not yet known to be exploited. No KEV listing and no EPSS score were provided in the input, and no public exploit or PoC is referenced (the issues.chromium.org link is the vendor bug tracker, not exploit code), so there is no evidence of active or at-scale exploitation at this time. One important nuance limits real-world impact: the description states code execution occurs 'inside the sandbox,' so a successful attack yields renderer-level compromise and still requires a separate sandbox-escape to fully take over the host - the C:H/I:H/A:H rating reflects impact within the sandboxed process, not confirmed host takeover. Missing/conflicting data to flag explicitly: EPSS and KEV status are absent from the input (cannot quantify exploitation probability or confirm in-the-wild use), and the CVSS scope is marked S:U despite the sandbox boundary being the practical containment - verify exploitation reach with the vendor advisory.

An attacker hosts or injects a malicious web page and lures a victim running a vulnerable Chrome build (prior to 156.0.8078.73) to visit it. When the page exercises the flawed Payments code path, it triggers memory corruption (CWE-119) that lets the attacker run arbitrary code within the browser's sandboxed renderer process. No public exploit is referenced; full host compromise would additionally require chaining a sandbox escape.