Live › vulnerability › CVE-2026-118351
Go to dashboardA memory corruption bug in Skia, the graphics library inside Google Chrome before 156.0.8078.73, can be triggered by a crafted HTML page. A remote attacker can execute arbitrary code inside the browser sandbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 23:29 UTC. All times on this page are UTC.
Any user or machine running Google Chrome older than 156.0.8078.73 is exposed, because the trigger is a web page the browser loads. Exposure is driven by browsing, so managed fleets and kiosks that open untrusted content are the priority. Systems that run no Chrome build below that version can skip it.
No product ranges from the sources yet.
156.0.8078.73156.0.8078.73 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-118351")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.