Loading vulnerability…
Sandboxed Code Execution in Google Chrome Skia
CVE-2026-118348 is an improper input validation vulnerability in the Skia component of Google Chrome before version 156.0.8078.73. Processing a crafted HTML page could allow a remote attacker to execute arbitrary code inside the browser sandbox. Chromium classifies the vulnerability as Critical. The specific vulnerable function and detailed validation failure are not publicly specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could compromise the confidentiality, integrity, and availability of resources accessible within the affected browser sandbox. Arbitrary code execution is potentially possible, but this vulnerability alone does not establish sandbox escape, operating-system compromise, or execution with unrestricted user privileges.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is specified. Reduce exposure through malicious-site filtering, restricting access to untrusted websites, maintaining browser sandboxing and available exploit protections, and running the browser without administrative privileges. These controls do not replace installing the fixed release.
Patch, then assume compromise.
Upgrade Google Chrome to version 156.0.8078.73 or later and relaunch the browser. For Microsoft Edge, upgrade to version 156.0.4314.58 or later. Update Chromium-based distribution packages through the applicable vendor security channel; Debian trixie fixes are available in version 156.0.8078.73-1~deb13u1. Where the distribution does not provide a patched package, use a supported browser build containing the fix.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.