CVE-2026-118335 in Chrome
Summary
by MITRE • 10/28/2026
Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified as an improper input validation flaw within Google Chrome's Metrics subsystem on macOS represents a significant risk vector for remote code execution. This issue stems from insufficient sanitization and boundary checking of data inputs processed by the browser's internal metrics collection mechanisms prior to version 156.0.8078.73. In modern web browsers, the renderer process operates within a strict sandbox environment designed to isolate untrusted content from the host operating system. However, when input validation is lax, an attacker can craft malicious HTML pages that exploit these weak points in the Metrics component. By submitting specially crafted data structures or malformed inputs, an adversary can trigger memory corruption errors such as buffer overflows or use-after-free conditions within the privileged context of the browser's internal processes.
The operational impact of this vulnerability is severe due to its potential for arbitrary code execution inside the sandbox. While the Chrome sandbox provides a robust defense-in-depth strategy by limiting the privileges of renderer processes, successful exploitation allows an attacker to escape these restrictions or execute malicious payloads with elevated permissions relative to standard web content. This capability enables the installation of malware, exfiltration of sensitive user data including cookies and credentials stored in browser profiles, and further lateral movement within a compromised system. The classification by Chromium as High severity underscores the critical nature of this flaw, indicating that it is relatively easy to exploit and has significant consequences for end-user security posture.
From a technical taxonomy perspective, this vulnerability aligns with CWE-20 Improper Input Validation, which covers cases where software does not adequately verify or incorrectly verifies input before processing. Furthermore, in the context of the MITRE ATT&CK framework, exploitation of such flaws typically falls under T1203 Exploitation for Client Execution, as it involves leveraging a vulnerability present on an end-user device to execute malicious code without user interaction beyond visiting a webpage. The attack vector is classified as Remote (Network), meaning no physical access or prior authentication is required, making this a prime target for drive-by download attacks and phishing campaigns that rely on social engineering to direct victims to the crafted HTML page.
Mitigation strategies primarily involve immediate patching of the Google Chrome browser to version 156.0.8078.73 or later, where these input validation checks have been hardened by Chromium engineers. Organizations should enforce automated update policies across all endpoints running macOS to ensure timely deployment of security patches. Additionally, users can employ defense-in-depth measures such as enabling Google Chrome's Site Isolation feature, which enhances the sandbox boundaries between different origins and reduces the blast radius of any potential exploitation attempt. Network-level controls like web filtering proxies that block access to known malicious domains or detect anomalous traffic patterns associated with exploit kits can also provide an additional layer of protection against drive-by attacks targeting this specific vulnerability.