CVE-2026-118317: Buffer Overflow

Q: Which Chrome versions are affected?

Google Chrome versions prior to 156.0.8078.73 are affected. Updating to 156.0.8078.73 or later addresses the affected version range described.

Q: What does an attacker need to exploit this issue?

An attacker would need to cause a user to process a crafted HTML page remotely. Successful exploitation could potentially execute arbitrary code inside Chrome's sandbox.

Q: Is this a sandbox escape?

The described impact is arbitrary code execution inside the sandbox. The available information does not state that the vulnerability allows an attacker to escape the sandbox or execute code on the underlying operating system.

Published Oct 27, 2026

Updated

Memory corruption in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected Software

1 affected component

Google Chrome<156.0.8078.73

Event History

Oct 27, 2026

CVE Published

via MITRE·11:03 PM

Data Sourced

via MITRE·11:03 PM

DescriptionWeakness

Frequently Asked Questions

Which Chrome versions are affected?

Google Chrome versions prior to 156.0.8078.73 are affected. Updating to 156.0.8078.73 or later addresses the affected version range described.

What does an attacker need to exploit this issue?

An attacker would need to cause a user to process a crafted HTML page remotely. Successful exploitation could potentially execute arbitrary code inside Chrome's sandbox.

Is this a sandbox escape?

The described impact is arbitrary code execution inside the sandbox. The available information does not state that the vulnerability allows an attacker to escape the sandbox or execute code on the underlying operating system.

CVE-2026-118317: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

Which Chrome versions are affected?

What does an attacker need to exploit this issue?

Is this a sandbox escape?

Company

Resources

Contact

Frequently Asked Questions

Which Chrome versions are affected?

What does an attacker need to exploit this issue?

Is this a sandbox escape?