External risk intelligence

Google Chrome Compositing Vulnerability Allows Sandbox Escape

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-118332

This vulnerability affects a client-side web browser. While it requires a user to navigate to a crafted HTML page, the vulnerability itself exists within the local browser application rather than being a public-facing service, gateway, or edge infrastructure that is reachable from the internet by design.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A recent vulnerability in Google Chrome's compositing functionality could allow attackers to execute code outside the browser's protected environment through a malicious webpage. This poses a potential risk if users are tricked into visiting such pages.

Web browser flaw allows code execution outside sandbox.
Confirms need to track browser updates for security.
Focus on user-aware browsing and browser patching.

Attack Path

How an attacker could exploit the issue

An attacker could exploit an improper input validation flaw in Chrome's Compositing feature by tricking a user into visiting a malicious HTML page. This could allow them to execute arbitrary code outside the browser's sandbox, potentially leading to system compromise. The vulnerability exists in Google Chrome prior to version 156.0.8078.73.

Requires user to visit a crafted page.
Exploits Compositing feature's input validation.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could execute arbitrary code outside the sandbox by tricking a user into visiting a malicious HTML page when supported by the advisory. This could impact the integrity and availability of the affected system.

Arbitrary code execution.
Visiting a malicious HTML page.
Compromised system integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Compositing within Google Chrome, rated Critical, allows for remote code execution via a crafted HTML page. Given its client-side nature, the primary responsibility likely falls to teams managing end-user computing environments and browser deployments, possibly in coordination with security operations for threat intelligence. The first practical step is to identify Chrome installations, assess user exposure, and prioritize remediation based on risk.

Own by end-user computing and browser teams.
Verify Chrome reachability and user exposure.
Plan phased deployment or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome and how does its compositing feature work?

Google Chrome is a web browser built on the Chromium engine. The compositing component is responsible for organizing the visual elements of a webpage and preparing them for the display. It handles how different layers of content, such as text, images, and video, are layered and rendered on your screen to ensure a smooth browsing experience.

What does improper input validation mean for CVE-2026-118332?

This vulnerability is classified as CWE-20, which occurs when a program fails to properly verify the data it receives from an external source. In this case, the browser's compositing feature does not sufficiently check the data provided by a malicious webpage. This flaw is significant because it allows the attacker's input to bypass the browser's sandbox, which is the security boundary intended to keep website code isolated from your computer's operating system.

How is this vulnerability triggered in Google Chrome?

An attacker triggers this bug by creating a specially crafted HTML page designed to exploit the input validation flaw. The process requires a user to navigate to the malicious site. Simply having the browser installed does not trigger the vulnerability; it remains inactive unless the browser processes the specific, harmful content on that page.

Is my system at risk if I use Chrome internally?

Halo Surface Signal notes this vulnerability is unlikely to be a direct target because it affects a local client-side browser rather than an internet-facing server. While the risk is lower for internal-only infrastructure, any user who browses the web from a managed device could potentially encounter a malicious page, making the vulnerability relevant to all endpoints running older versions.

How do I address CVE-2026-118332 on my systems?

The primary response is to update Google Chrome to version 156.0.8078.73 or later. Since this is a client-side issue, teams managing end-user devices should prioritize deploying this browser update. You can begin by verifying which machines are running outdated versions to ensure the patch is applied across your environment.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.