Loading vulnerability…
Sandboxed Code Execution in Google Chrome WebRTC
CVE-2026-118328 is an improper input validation vulnerability in the WebRTC component of Google Chrome before version 156.0.8078.73. A remote attacker can potentially trigger arbitrary code execution inside the browser sandbox by inducing a user to load a crafted HTML page. Chromium classifies the vulnerability as High severity. Chromium-based Microsoft Edge is also affected. The specific vulnerable function and malformed input characteristics have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could compromise the confidentiality, integrity, and availability of resources accessible within the affected browser sandbox through arbitrary code execution. The vulnerability does not establish a sandbox escape or execution with unrestricted operating-system privileges. Its CVSS v3.0 base score is 8.8, with vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is documented. Restricting access to untrusted websites and applying web filtering can reduce exposure to crafted pages but do not replace installing the security update.
Patch, then assume compromise.
Upgrade Google Chrome and affected Chromium packages to version 156.0.8078.73 or later, then relaunch the browser. Upgrade Microsoft Edge to version 156.0.4314.58 or later. For Debian stable (trixie), install Chromium version 156.0.8078.73-1~deb13u1 or later. For other distributions, install the corresponding vendor security update; availability and release-channel status vary.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.