Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-118345 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-111457
Vulnerability Data
Buffer overflow in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
MITRE ATT&CK v20.0
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.4.1
Mitigating Controls (NIST 800-53 r5)
Our mappings, made for this CVE.
Developer testing and evaluation can discover use-after-free bugs through dynamic analysis or fuzzing.
Engineering principles can require memory-safe constructs or languages that structurally avoid introducing use-after-free.
Mitigating Controls (NIST CSF 2.0)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.
Secure-development practices directly require bounds checking and safe memory handling that prevent heap overflows.
Vulnerability scanning and recording can discover heap-overflow flaws but does not prevent their introduction in code.
Timely patching removes known heap-overflow instances after they exist.
Mitigating Controls (ISO/IEC 27001:2022 Annex A)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.
Security testing in development and acceptance can detect heap overflows before release.
Secure coding standards directly prescribe techniques (safe functions, bounds checks) that prevent heap-based buffer overflows.
A.8.30 carries its effect through the secure design, coding and testing practices its contract requires of the supplier (8.25-8.29), so a faithfully implemented clause reduces ordinary implementation-phase software weaknesses like heap-based buffer overflows in delivered code, but the effect is mediated by supplier practice and is bounded by the ceiling the owner has set on this clause for this verb.
A.8.8's reach is DISCLOSURE — it surfaces heap-based buffer overflows only where they appear as published CVEs in third-party components in the inventory. CWE-122 is overwhelmingly an implementation-phase defect in custom code, which A.8.8 does not read; the disclosed third-party share is a minority, matching the same logic that graded A.8.8 -> CWE-89 at `partial`.