CVE-2026-118331

Published Oct 27, 2026

Last updated 5 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-118331 is a vulnerability affecting Google Chrome and other Chromium-based browsers, such as Microsoft Edge, prior to version 156.0.8078.73. The issue stems from improper input validation within the browser's FileAPI component. A remote attacker could exploit this flaw by convincing a user to visit a specially crafted HTML page, potentially allowing the attacker to execute arbitrary code within the browser's sandboxed environment. The vulnerability was discovered and reported by Anthropic researcher Xinyang Ge, who utilized the Claude AI model to assist in identifying the flaw. Google addressed the issue in late October 2026 with the release of Chrome version 156.0.8078.73/.74 for Windows and macOS, and 156.0.8078.73 for Linux. Users and administrators are advised to update their browsers to the latest version to mitigate the risk of exploitation.

Description: Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Source: chrome-cve-admin@google.com
NVD status: Analyzed
Products: chrome

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

chrome-cve-admin@google.com: CWE-20

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 59

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "0ED873DB-C137-42EB-9F05-A7E15AE97E44",
            "versionEndExcluding": "156.0.8078.73",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.