Zero Radar
← feed
CriticalVulnerabilityCVE-2026-118331updated 31 Oct 2026, 18:00 UTC

Google Chrome flaw lets a malicious web page run code inside the browser sandbox

A specially crafted web page could make Chrome run an attacker's code. The browser's sandbox limits the damage, but the flaw is still serious, so update now.

Fix availableOfficial, 3 sources
SeverityCriticalCVSS 8.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesGoogle Chrome 156.0.8078.73 or later; ChromeOS 16836.30.0 with Browser 156.0.8078.77 or later. Microsoft Edge: fixed through the Chromium update (exact version not stated). · since 28 Oct 2026
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker builds pageCrafted HTML triggers the input validation flaw
  2. 2Victim visits pagePage loads in an unpatched browser
  3. 3FileAPI mishandles inputImproper validation in FileAPI component
  4. 4Code runs in sandboxArbitrary code execution inside the sandbox
  5. ResultAttacker runs code inside the browser sandbox

What happened

Improper input validation in Chrome's FileAPI component before 156.0.8078.73 allows a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Google rates it Critical.

Why it is dangerous: Anyone who visits a malicious or compromised web page in an unpatched browser could be exposed. Microsoft Edge also ingests the Chromium fix, so Edge users are affected too.

Are you affected?

You are affected if you run Google Chrome before 156.0.8078.73, ChromeOS or ChromeOS Flex without the Stable channel update, or a Chromium-based Microsoft Edge build that lacks the Chromium fix.

Google Chrome prior to 156.0.8078.73; ChromeOS / ChromeOS Flex Stable channel builds before the update that ships Browser 156.0.8078.77 (ChromeOS 16836.30.0); Microsoft Edge (Chromium-based) builds without the Chromium fix (exact Edge versions unknown).

What to do

  1. Update Google Chrome to version 156.0.8078.73 or later (check at chrome://settings/help).
  2. On ChromeOS or ChromeOS Flex, install the Stable channel update to 16836.30.0 (Browser 156.0.8078.77).
  3. Update Microsoft Edge to the latest build, which includes the Chromium fix.
  4. Restart the browser after updating so the fix takes effect.

Timeline

  1. 27 Oct 2026, 23:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 19:45 UTC
    Reported by Google Chrome · Google Chrome
  3. 28 Oct 2026, 20:32 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 04:19 UTC
    NVD reported on it · NVD
  5. 31 Oct 2026, 18:00 UTC
    Microsoft MSRC reported on it · Microsoft MSRC

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118331
CVSS
8.8 / 10
Disclosed
27 Oct 2026, 23:17 UTC
On Zero Radar
28 Oct 2026, 20:32 UTC (21 h after disclosure)
Last change
31 Oct 2026, 18:00 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Google Chrome flaw lets a malicious web page run code inside the browser sandbox · Zero Radar