Live › vulnerability › CVE-2026-118354
Go to dashboardGoogle Chrome's Skia graphics library does not validate input properly, so a crafted HTML page can make the browser execute attacker code inside its sandbox. The attacker needs the victim to load the page, and the sandbox limits what the code can reach on the machine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 23:29 UTC. All times on this page are UTC.
Anyone running Google Chrome before 156.0.8078.73 is exposed, since the flaw is in the browser's rendering code and any web page can trigger it. Servers, CI runners and other systems that do not run a desktop browser with untrusted web content can skip it. Chromium-based browsers that pick up Skia from upstream may also need their own updates; the sources do not say which.
No product ranges from the sources yet.
chrome://version in Chrome and compare the version shown with 156.0.8078.73156.0.8078.73 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-118354")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.