CVE-2026-118355
published 2026-10-27CVE-2026-118355: Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the…
PriorityP356critical9.6CVSS 3.1
AVNACLPRNUIRSCCHIHAH
EPSS
0.21%
10.8th percentile
Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | >= 156.0.8078.73 < 156.0.8078.73 | 156.0.8078.73 | |
| chrome_desktop | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Chrome
Stable Channel Update for Desktop: CVE-2026-118355
vendor_chrome·2026-10-27
CVE-2026-118355 [HIGH] Stable Channel Update for Desktop: CVE-2026-118355
Stable Channel Update for Desktop
CVE-2026-118355: Improper input validation in Command. Reported by Xinyang Ge on 2026-10-06 [N/A][ 570675085 ] High CVE-2026-118307: Use after free in Paint
Reported by Xinyang Ge on 2026-10-06 [N/A][ 570825067 ] High CVE-2026-118351: Memory corruption in Skia
Severity: high
VulDB
Google Chrome up to 156.0.8078.47 input validation
vuldb·2026-10-28
CVE-2026-118355 [CRITICAL] Google Chrome up to 156.0.8078.47 input validation
A vulnerability was found in Google Chrome. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to improper input validation.
This vulnerability is uniquely identified as CVE-2026-118355. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is advised.
GHSA
Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
ghsa_unreviewed·2026-10-28
CVE-2026-118355 CWE-20 Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
No detection rules found.
No public exploits indexed.
2026-10-27
Published