Google Chrome: Improper input validation in Headless mode
Summary
Google Chrome Headless mode contains an improper input validation flaw (CWE-20). A remote attacker who gets a user to open a crafted HTML page may be able to execute arbitrary code inside the browser sandbox. Exploitation requires user interaction, and the impact is rated High by Chromium.
Affected
- Google Chrome prior to 156.0.8078.73 (Chromium Headless mode)
- Per CIS, Windows and Mac builds 156.0.8078.73 and 156.0.8078.74 are also listed as affected in some sources; check your installed version
- Separate Chromium builds used by headless automation tools (Puppeteer, Playwright, Selenium) may be affected; verify the binary they launch
Fixed in
- Google Chrome 156.0.8078.73 (Linux)
- Google Chrome 156.0.8078.73 or 156.0.8078.74 (Windows and Mac, per CIS)
- Ubuntu: chromium-browser snap is not affected; Google Chrome packages are at 156.0.8078.73-1
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild (OffSeq tracker).
- No public exploit code known as of 26 Oct 2026.
- A third-party tracker lists it as not in the CISA KEV catalog; confirm on the CISA website.
- EPSS: 0.32 % (percentile 25) per the provided data; a third-party source shows 0.22 %.
Our recommendation
- Update Google Chrome to 156.0.8078.73 or later (including 156.0.8078.74 on Windows and Mac) through your normal update channel.
- Identify headless Chrome or Chromium installations on servers, CI runners, scraping jobs and rendering services, and update them with priority, since they often run unattended and may not auto-update.
- Avoid rendering untrusted HTML in headless instances, and limit their network access to internal systems.
- Patch the whole 156.0.8078.73 update, which fixes further high and critical flaws.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Ubuntu security notice CVE-2026-118336 ubuntu.com
- CIS advisory: Multiple vulnerabilities in Google Chrome www.cisecurity.org
- OffSeq threat radar CVE-2026-118336 radar.offseq.com
- Malware.news: Chrome and Firefox updates fix serious security flaws malware.news
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:00.
Original description (NVD)
Improper input validation in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.