{"id":"CVE-2026-118340","kind":"vulnerability","aliases":["CVE-2026-118340"],"related":[],"title":"Chrome: Skia memory corruption lets a crafted page run code","description":"Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"Google Chrome before 156.0.8078.73 has a memory corruption bug in its Skia graphics library. A remote attacker who gets a user to open a crafted HTML page can potentially execute arbitrary code outside the browser sandbox.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","chrome","desktop","endpoints","other"],"not_affected_if":["chrome-156.0.8078.73-or-later"],"how_to_check":"- Open Chrome and check the version under Settings > About Chrome; versions below `156.0.8078.73` are affected.\n- On managed fleets, query the installed Chrome version with your endpoint management tool.","fix":"- Update Google Chrome to `156.0.8078.73` or later, then restart the browser.","status":"open","published_at":"2026-10-27T23:17:02+00:00","first_seen_at":"2026-10-27T23:29:43+00:00","triaged_at":"2026-10-27T23:31:42+00:00","updated_at":"2026-10-27T23:31:42+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-27T23:31:42Z","model":"claude-haiku-5-5","output":{"fix":"- Update Google Chrome to `156.0.8078.73` or later, then restart the browser.","reach":"internet","title":"Chrome: Skia memory corruption lets a crafted page run code","impact":"high","summary":"Google Chrome before 156.0.8078.73 has a memory corruption bug in its Skia graphics library. A remote attacker who gets a user to open a crafted HTML page can potentially execute arbitrary code outside the browser sandbox.","category":"other","nicknames":[],"who_cares":["chrome","browsers","endpoints","desktop"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code outside the browser sandbox after a user visits a page","analyst_note":"","how_to_check":"- Open Chrome and check the version under Settings > About Chrome; versions below `156.0.8078.73` are affected.\n- On managed fleets, query the installed Chrome version with your endpoint management tool.","needs_analyst":false,"not_affected_if":["chrome-156.0.8078.73-or-later"],"who_is_affected":"Anyone running Google Chrome before 156.0.8078.73 on desktop or on machines where Chrome is installed for users. Exposure comes from browsing untrusted pages, so any browsing user is in scope. Teams using a different browser engine or a Chrome build already at 156.0.8078.73 or later can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000588,"input_tokens":3297,"output_tokens":516,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118340':13A,16A '-2026':12A,15A '156.0.8078.73':24B,66C 'allow':67C 'arbitrari':51B,74C 'attack':37B,70C 'browser':17B,55B 'bug':29B 'chrome':1A,18B,22B,63C 'chromium':84C 'code':10A,52B,75C 'corrupt':4A,28B,58C 'craft':7A,45B,81C 'cve':11A,14A 'desktop':19B 'endpoint':20B 'execut':50B,73C 'get':39B 'googl':21B,62C 'graphic':33B 'high':87C 'html':46B,82C 'let':5A 'librari':34B 'memori':3A,27B,57C 'open':43B 'outsid':53B,76C 'page':8A,47B,83C 'potenti':49B,72C 'prior':64C 'remot':36B,69C 'run':9A 'sandbox':56B,78C 'secur':85C 'sever':86C 'skia':2A,32B,60C 'user':41B 'via':79C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Google Chrome before 156.0.8078.73 on desktop or on machines where Chrome is installed for users. Exposure comes from browsing untrusted pages, so any browsing user is in scope. Teams using a different browser engine or a Chrome build already at 156.0.8078.73 or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T23:17:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118340","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118340","severity":null,"published_at":"2026-10-27T23:17:02+00:00","modified_at":"2026-10-27T23:17:02+00:00","first_seen_at":"2026-10-27T23:29:43+00:00","fetched_at":"2026-10-27T23:29:43+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}