CVE-2026-118320: V8 memory corruption flaw in Chrome

CVE-2026-118320 concerns a memory corruption issue in Google Chrome's V8 JavaScript engine. According to the official NVD description, a remote attacker could exploit a specially crafted HTML page to corrupt JavaScript execution state and potentially execute arbitrary code inside the browser sandbox, in Chrome versions prior to 156.0.8078.73.

The vulnerability carries a CVSS score of 8.8, high severity band, consistent with the Chromium-declared severity of 'High'. It was published on NVD on October 27, 2026. No signal of public GitHub exploit repositories was found. Limited, unverified social media activity has been observed, with a few posts in the last 24 hours: this only indicates community interest, not confirmed active exploitation.

For defenders, the priority is updating Chrome to version 156.0.8078.73 or later across all corporate endpoints, ensuring automatic updates are enabled and forcing a browser restart after the update. It is advisable to monitor browsing logs for anomalous pages and remind users to avoid untrusted sites until the update is complete.