Live › vulnerability › CVE-2026-118328
Go to dashboardGoogle Chrome versions before 156.0.8078.73 have an improper input validation bug in WebRTC. A remote attacker who lures a user to a crafted HTML page can potentially execute arbitrary code inside the browser sandbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 23:29 UTC. All times on this page are UTC.
Any user or managed fleet running Google Chrome before is exposed when they visit a malicious page. Teams that only run Chromium builds from other vendors should check those vendors' fixes instead. Servers and automated pipelines that do not browse untrusted content are less exposed.
156.0.8078.73No product ranges from the sources yet.
chrome --version where the binary is available.156.0.8078.73.156.0.8078.73 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper input validation in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-118328")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.