CVE-2026-118331

Published 27 October 2026 · tracked since 28 October 2026

Description

Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-103688 CRITICAL 9.8
• CVE-2026-84999 CRITICAL 9.8
• CVE-2026-106013 CRITICAL 9.8
• CVE-2026-58256 CRITICAL 9.1
• CVE-2026-118355 CRITICAL 9.6
• CVE-2026-118341 HIGH 8.8
• CVE-2026-118342 CRITICAL 9.6
• CVE-2026-118343 HIGH 8.8
• CVE-2026-118344 HIGH 8.8
• CVE-2026-118345 HIGH 8.8

→ Open the live CVE board · all tools