# CVE-2026-118331: Google Chrome

- Exploited (CISA KEV): no
- Published: 2026-10-27
- CVSS: 8.8 HIGH (v3.1)
- EPSS: 0.3% (28th percentile)
- CWE: CWE-20

Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

2 posts seen since 2026-11-02.

- bluesky 2026-11-02: CVE-2026-118331 is trending. Hype score 53, currently #3 on cvemon.  Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML…  https://cvemon.intruder.io/cv… (https://bsky.app/profile/cvemon.bsky.social/post/3mzecdvmvd72z)
- x 2026-11-02: @poteto @bot Did the team fix this security flaw? The latest (1.64.1) bundles early Chromium.156 with CVE-2026-118306  CVE-2026-118331 CVE-2026-118348 CVE-2026-118344 (https://x.com/T54321X/status/2117367149882929564)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-118331 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-118331