CVE-2026-118332
published 2026-10-27CVE-2026-118332: Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the…
PriorityP356critical9.6CVSS 3.1
AVNACLPRNUIRSCCHIHAH
EPSS
0.21%
10.8th percentile
Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | >= 156.0.8078.73 < 156.0.8078.73 | 156.0.8078.73 | |
| chrome_desktop | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Chrome
Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2026-118332
vendor_chrome·2026-10-28·CVSS 9.6
CVE-2026-118332 [CRITICAL] Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2026-118332
Stable Channel Update for ChromeOS / ChromeOS Flex
CVE-2026-118332
Chrome
Stable Channel Update for Desktop: CVE-2026-118334
vendor_chrome·2026-10-27
CVE-2026-118334 [HIGH] Stable Channel Update for Desktop: CVE-2026-118334
Stable Channel Update for Desktop
CVE-2026-118334: Use after free in ImageCapture. Reported by OpenAI Codex Security (kylebot) on 2026-10-15 [TBD][ 574030524 ] High CVE-2026-118332: Improper input validation in Compositing
Reported by e7be95afd6e4ad8d8abc6076c284c79db9e35cc2 on 2026-10-15 [N/A][ 574032795 ] High CVE-2026-118313: Use after free in Video
Severity: high
GHSA
Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
ghsa_unreviewed·2026-10-28
CVE-2026-118332 CWE-20 Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
VulDB
Google Chrome up to 156.0.8078.47 Compositing input validation
vuldb·2026-10-28
CVE-2026-118332 [CRITICAL] Google Chrome up to 156.0.8078.47 Compositing input validation
A vulnerability classified as critical was found in Google Chrome. This affects an unknown part of the component Compositing. Such manipulation leads to improper input validation.
This vulnerability is documented as CVE-2026-118332. The attack can be executed remotely. There is not any exploit available.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
2026-10-27
Published