Google Chrome CVE-2026-118355

Exploitation requires a victim using a vulnerable Google Chrome desktop version (prior to 156.0.8078.73) to load attacker-controlled HTML content; per the CVSS vector no authentication is needed (PR:N) but user interaction is required (UI:R), i.e. the victim must visit or render the crafted page. This affects default configurations - no special feature or non-default setting is cited in the available sources. The principal limiting factor is the need for user interaction (visiting a malicious or compromised page); the specific input that triggers the improper validation is not detailed in the available data.

This is a genuine high-priority issue despite a low EPSS score. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page, with a changed scope reflecting a sandbox escape (code execution outside Chrome's renderer sandbox). The vuln.today decision label is act_now and a vendor patch is already available, which together argue for prompt remediation. The signals partly conflict: EPSS is only 0.21% (11th percentile) and the vulnerability is NOT on CISA KEV, indicating no confirmed active exploitation and no evidence of widespread automated exploitation at this time - the low EPSS likely reflects that no public exploit chain has yet appeared rather than low impact. There is no POC or exploit reference in the supplied data (only the vendor blog, the restricted Chromium issue tracker entry, and NVD). The practical risk is therefore driven by the combination of the vulnerability's severity, the near-universal deployment of Chrome, and the act_now priority - not by current exploitation evidence. The UI:R requirement (user must visit a page) is the main real-world limiter.

An attacker hosts or compromises a web page containing crafted content that triggers improper input validation in the affected Chrome component; when a victim running a vulnerable Chrome version (prior to 156.0.8078.73) visits it, the attacker potentially achieves code execution outside the browser sandbox on the victim's host. No authentication is required but the victim must load the malicious page (UI:R). No public exploit code is identified in the available data.