CVE-2026-118332EUVD-2026-111455GHSA-PV6F-R7PM-PF6M
Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 156.0.8078.73
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: no
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
Google Chrome, the web browser, is affected by this vulnerability. An attacker could potentially run arbitrary code outside the browser's security sandbox by tricking a user into opening a specially crafted web page.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected versions
- Google Chrome
From 156.0.8078.73 · fixed in 156.0.8078.73