CVE-2026-118331
published 2026-10-27CVE-2026-118331: Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox…
PriorityP353high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.34%
27.5th percentile
Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 156.0.8078.73 | 156.0.8078.73 | |
| chrome | >= 156.0.8078.73 < 156.0.8078.73 | 156.0.8078.73 | |
| chrome_desktop | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
ghsa_unreviewed·2026-10-28
CVE-2026-118331 CWE-20 Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
VulDB
Google Chrome up to 156.0.8078.47 FileAPI input validation
vuldb·2026-10-28
CVE-2026-118331 [CRITICAL] Google Chrome up to 156.0.8078.47 FileAPI input validation
A vulnerability described as critical has been identified in Google Chrome. Affected by this vulnerability is an unknown functionality of the component FileAPI. The manipulation results in improper input validation.
This vulnerability is cataloged as CVE-2026-118331. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is recommended.
Chrome
Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2026-118331
vendor_chrome·2026-10-28·CVSS 8.8
CVE-2026-118331 [HIGH] Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2026-118331
Stable Channel Update for ChromeOS / ChromeOS Flex
CVE-2026-118331
Red Hat
chromium-browser: Improper input validation in FileAPI
vendor_redhat·2026-10-27·CVSS 8.8
CVE-2026-118331 [HIGH] CWE-20 chromium-browser: Improper input validation in FileAPI
chromium-browser: Improper input validation in FileAPI
Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
An improper input validation flaw was found in the FileAPI component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/572193211
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Chrome
Stable Channel Update for Desktop: CVE-2026-118306
vendor_chrome·2026-10-27
CVE-2026-118306 [CRITICAL] Stable Channel Update for Desktop: CVE-2026-118306
Stable Channel Update for Desktop
CVE-2026-118306: Memory corruption in FileSystem. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-10-07 [TBD][ 572193211 ] Critical CVE-2026-118331: Improper input validation in FileAPI
Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-10-11 [N/A][ 574776938 ] Critical CVE-2026-118348: Improper input validation in Skia
Severity: critical
No detection rules found.
No public exploits indexed.
2026-10-27
Published