CVE-2026-118348: Input Validation

Q: Which Chrome versions are affected?

Google Chrome versions prior to 156.0.8078.73 are affected. The provided information does not identify affected platforms or release channels beyond Chrome.

Q: What must an attacker do to exploit this issue?

An attacker would need to cause a user to process a crafted HTML page remotely. Successful exploitation could potentially execute arbitrary code inside the Chrome sandbox.

Q: Does this vulnerability allow an attacker to escape the Chrome sandbox?

The provided information states that code execution is possible inside the sandbox. It does not state that the issue enables a sandbox escape or execution outside the sandbox.

Published Oct 27, 2026

Updated

Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Affected Software

1 affected component

Google Chrome<156.0.8078.73

Event History

Oct 27, 2026

CVE Published

via MITRE·11:03 PM

Data Sourced

via MITRE·11:03 PM

DescriptionWeakness

Frequently Asked Questions

Which Chrome versions are affected?

Google Chrome versions prior to 156.0.8078.73 are affected. The provided information does not identify affected platforms or release channels beyond Chrome.

What must an attacker do to exploit this issue?

An attacker would need to cause a user to process a crafted HTML page remotely. Successful exploitation could potentially execute arbitrary code inside the Chrome sandbox.

Does this vulnerability allow an attacker to escape the Chrome sandbox?

The provided information states that code execution is possible inside the sandbox. It does not state that the issue enables a sandbox escape or execution outside the sandbox.

CVE-2026-118348: Input Validation

Affected Software

Event History

Frequently Asked Questions

Which Chrome versions are affected?

What must an attacker do to exploit this issue?

Does this vulnerability allow an attacker to escape the Chrome sandbox?

Company

Resources

Contact

Frequently Asked Questions

Which Chrome versions are affected?

What must an attacker do to exploit this issue?

Does this vulnerability allow an attacker to escape the Chrome sandbox?