Google Chrome CVE-2026-118352

Exploitation requires the victim to load attacker-controlled crafted HTML in a vulnerable Chrome build (any version prior to 156.0.8078.73); per CVSS UI:R, user interaction (navigating to the page) is mandatory, which is the primary limiting factor and precludes fully passive, zero-click compromise. No authentication is required (PR:N) and the product's default configuration is affected - no special feature or non-default setting is named in the available data. A key containment limit stated by the vendor: code execution is confined to the renderer sandbox, so this flaw alone does not grant host-level control without an additional sandbox-escape vulnerability.

This is a genuine high-priority browser vulnerability, though not a drop-everything emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable flaw requiring no privileges and low complexity, with full confidentiality/integrity/availability impact, gated only by user interaction (the victim must load a crafted HTML page). Chromium itself rated the severity High. The vuln.today decision label is 'this_week', which signals prompt remediation but not immediate crisis response. Critically, no KEV listing is present (not confirmed actively exploited), no EPSS score was supplied, and no verified working exploit code is referenced - so there is no signal of widespread or in-the-wild exploitation at this time. One important nuance the description states explicitly: code execution occurs 'inside the sandbox', meaning a successful exploit of this bug alone does not escape Chrome's renderer sandbox and would typically need to be chained with a separate sandbox-escape to fully compromise the host; the CVSS C:H/I:H/A:H reflects worst-case impact within the renderer context. Given Chrome's ubiquity, even a user-interaction-gated, sandbox-contained RCE warrants prompt patching, but the absence of KEV/EPSS/POC confirmation means this is driven by severity and exposure rather than demonstrated active abuse.

An attacker hosts or compromises a web page containing crafted HTML that triggers the memory-corruption flaw in Chrome's Cache component when a victim visits it. Because exploitation requires the user to navigate to the malicious page (UI:R), delivery relies on phishing, malvertising, or a watering-hole; no authentication is needed. Successful exploitation yields potential arbitrary code execution inside the renderer sandbox, which an attacker would typically pair with a sandbox escape for full host compromise. No verified public exploit code is referenced in the available data.