Live › vulnerability › CVE-2026-118331
Go to dashboardGoogle Chrome before 156.0.8078.73 mishandles input in its FileAPI, so a crafted HTML page can make the browser run attacker code inside the renderer sandbox. Chromium rates the flaw Critical.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 23:29 UTC. All times on this page are UTC.
Anyone running Google Chrome older than 156.0.8078.73 is exposed, since the attack needs only a victim who opens a crafted page. Teams that manage browsers on employee machines or kiosks should look at those, and web servers and apps do not need changes for this. Systems on a version at or above the fixed build can skip it.
No product ranges from the sources yet.
chrome://version in Chrome and compare the version with 156.0.8078.73156.0.8078.73 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
This page as .md · .json · in your agent: get_signal("CVE-2026-118331")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.