{"id":"CVE-2026-118354","kind":"vulnerability","aliases":["CVE-2026-118354"],"related":[],"title":"Chrome: Skia input validation flaw lets crafted page run code in sandbox","description":"Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"Google Chrome's Skia graphics library does not validate input properly, so a crafted HTML page can make the browser execute attacker code inside its sandbox. The attacker needs the victim to load the page, and the sandbox limits what the code can reach on the machine.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","chrome","desktop-fleets","other"],"not_affected_if":["chrome-at-or-above-156.0.8078.73","no-browser-installed"],"how_to_check":"- Run `chrome://version` in Chrome and compare the version shown with `156.0.8078.73`\n- Check the installed version on managed machines with your browser management tool; the sources do not name one","fix":"- Update Google Chrome to `156.0.8078.73` or later\n- Restart the browser after the update so the new version is active","status":"open","published_at":"2026-10-27T23:17:04+00:00","first_seen_at":"2026-10-27T23:29:44+00:00","triaged_at":"2026-10-27T23:31:30+00:00","updated_at":"2026-10-27T23:31:30+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-27T23:31:30Z","model":"claude-haiku-5-5","output":{"fix":"- Update Google Chrome to `156.0.8078.73` or later\n- Restart the browser after the update so the new version is active","reach":"internet","title":"Chrome: Skia input validation flaw lets crafted page run code in sandbox","impact":"high","summary":"Google Chrome's Skia graphics library does not validate input properly, so a crafted HTML page can make the browser execute attacker code inside its sandbox. The attacker needs the victim to load the page, and the sandbox limits what the code can reach on the machine.","category":"other","nicknames":[],"who_cares":["chrome","browsers","desktop-fleets"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker code runs inside the browser sandbox after a victim visits a page","analyst_note":"Check the Chrome release notes and the Chromium bug entry for CVE-2026-118354 to confirm the sandbox-only scope and whether a sandbox escape is known.","how_to_check":"- Run `chrome://version` in Chrome and compare the version shown with `156.0.8078.73`\n- Check the installed version on managed machines with your browser management tool; the sources do not name one","needs_analyst":true,"not_affected_if":["chrome-at-or-above-156.0.8078.73","no-browser-installed"],"who_is_affected":"Anyone running Google Chrome before 156.0.8078.73 is exposed, since the flaw is in the browser's rendering code and any web page can trigger it. Servers, CI runners and other systems that do not run a desktop browser with untrusted web content can skip it. Chromium-based browsers that pick up Skia from upstream may also need their own updates; the sources do not say which.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000636,"input_tokens":3295,"output_tokens":613,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118354':15A,18A '-2026':14A,17A '156.0.8078.73':81C 'allow':82C 'arbitrari':89C 'attack':45B,51B,85C 'browser':19B,43B 'chrome':1A,20B,25B,78C 'chromium':99C 'code':10A,46B,65B,90C 'craft':7A,37B,96C 'cve':13A,16A 'desktop':22B 'desktop-fleet':21B 'execut':44B,88C 'flaw':5A 'fleet':23B 'googl':24B,77C 'graphic':28B 'high':102C 'html':38B,97C 'improp':71C 'input':3A,33B,72C 'insid':47B,91C 'let':6A 'librari':29B 'limit':62B 'load':56B 'machin':70B 'make':41B 'need':52B 'page':8A,39B,58B,98C 'potenti':87C 'prior':79C 'proper':34B 'reach':67B 'remot':84C 'run':9A 'sandbox':12A,49B,61B,93C 'secur':100C 'sever':101C 'skia':2A,27B,75C 'valid':4A,32B,73C 'via':94C 'victim':54B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Google Chrome before 156.0.8078.73 is exposed, since the flaw is in the browser's rendering code and any web page can trigger it. Servers, CI runners and other systems that do not run a desktop browser with untrusted web content can skip it. Chromium-based browsers that pick up Skia from upstream may also need their own updates; the sources do not say which.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T23:17:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118354","severity":null,"published_at":"2026-10-27T23:17:04+00:00","modified_at":"2026-10-27T23:17:04+00:00","first_seen_at":"2026-10-27T23:29:44+00:00","fetched_at":"2026-10-27T23:29:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}