Live › vulnerability › CVE-2026-118316
Go to dashboardImproper input validation in the V8 JavaScript engine in Google Chrome before 156.0.8078.73 lets a remote attacker run arbitrary code outside the browser sandbox. The attack is delivered through a crafted HTML page that a user visits.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 23:29 UTC. All times on this page are UTC.
Any machine running Google Chrome before is exposed when a user browses to a malicious page. Managed browsers that auto-update are usually patched already, but check fleets and kiosks that pin versions. Teams with no Chrome installs outside of Chromium-based tooling can skip it.
156.0.8078.73No product ranges from the sources yet.
google-chrome --version on Linux156.0.8078.73156.0.8078.73 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-118316")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.