Vulnerability record

CVE-2026-118332

CriticalNo known exploitation

Patch status

Official fix available since Oct 27, 2026

Apply the vendor's update to every affected system. Check the fixed-in versions below where known.

Basis: Google Chrome Releases vendor advisory

Description

Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Intelligence timeline

Developments from the last 30 days, newest first.

CVSS scoredUpdateOct 28, 2026
CVE-2026-118332 scored CVSS 9.6
Basis: NIST National Vulnerability Database

Coverage

CriticalPatch

Beta Channel Update for ChromeOS / ChromeOS Flex

Patch

Apply the vendor's security update for Chrome.

Google Chrome Releases · 2 sources

Vendor advisoryGoogle Chrome Releases
Vendor advisoryGoogle Chrome Releases

yesterdayHomeSMBEnterprise

References

chromereleases.googleblog.com https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html
issues.chromium.org https://issues.chromium.org/issues/574030524