---
id: "CVE-2026-118354"
kind: "vulnerability"
aliases: ["CVE-2026-118354"]
title: "Chrome: Skia input validation flaw lets crafted page run code in sandbox"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["browsers", "chrome", "desktop-fleets", "other"]
not_affected_if: ["chrome-at-or-above-156.0.8078.73", "no-browser-installed"]
published_at: "2026-10-27T23:17:04+00:00"
first_seen_at: "2026-10-27T23:29:44+00:00"
updated_at: "2026-10-27T23:31:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118354", "first_seen_at": "2026-10-27T23:29:44+00:00"}]
---

# Chrome: Skia input validation flaw lets crafted page run code in sandbox

Google Chrome's Skia graphics library does not validate input properly, so a crafted HTML page can make the browser execute attacker code inside its sandbox. The attacker needs the victim to load the page, and the sandbox limits what the code can reach on the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `chrome://version` in Chrome and compare the version shown with `156.0.8078.73`
- Check the installed version on managed machines with your browser management tool; the sources do not name one

## Fix

- Update Google Chrome to `156.0.8078.73` or later
- Restart the browser after the update so the new version is active

## Timeline

- 2026-10-27T23:29:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118354

## From the sources

Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_