EUVD-2026-102514
GHSA-f4g7-767f-656r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitDeliver malicious SVG content
-
ExecutionTrigger memory corruption in SVG renderer
-
ImpactRead out-of-bounds process memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use an affected Google Chrome build prior to 155.0.8059.84 and to actively open attacker-controlled web content (UI:R) that embeds a crafted SVG image processed by Chrome's SVG rendering path. No authentication or special privileges are needed (PR:N), and default configurations are affected since SVG rendering is enabled by default. Limiting factors: the attacker cannot act without user interaction (visiting the page), the flaw yields only a memory read (no code execution or data modification on its own), and patched builds are immune. |
| Impact | This is a genuine but comparatively LOW-priority issue despite the 'High' Chromium internal severity label. The signals are consistent rather than conflicting: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) yields only 4.3 (Medium) because the sole impact is a partial confidentiality loss (memory read) with no integrity or availability impact, and exploitation requires user interaction (UI:R - the victim must open a crafted HTML page). CISA's SSVC decision framework corroborates the low urgency: Exploitation=none (no observed exploitation), Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no EPSS score was supplied, so there is no quantitative exploitation-probability signal; absence of EPSS is a data gap, not evidence of safety. No public PoC is referenced. The one tension worth noting is the gap between Google's internal 'High' severity (which reflects the memory-safety class and Chrome's huge attack surface) and the modest CVSS base score - this is typical for info-leak-only memory bugs and does not indicate a scoring error. Net: real but routine; patch in normal cadence, not emergency. |
| Exploit ScenarioDerived | An attacker hosts a web page containing a maliciously crafted SVG and lures a victim running a vulnerable Chrome (<155.0.8059.84) to visit it; when Chrome renders the SVG, a buffer over-read discloses a slice of browser process memory to the attacker, potentially leaking pointers useful for defeating ASLR or fragments of sensitive data. No public exploit code is identified at time of analysis, and successful exploitation requires the victim to actively visit the attacker-controlled page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Memory corruption in Google Chrome's SVG rendering path affects builds prior to 155.0.8059.84 and allows a remote, unauthenticated attacker to read memory from the browser process when a victim opens a crafted HTML page that embeds a malicious SVG image. The flaw is confined to an information disclosure (CVSS 4.3, C:L/I:N/A:N) - no code execution or data modification - and, per the assessed vector (AV:N/AC:L/PR:N/UI:R), requires no privileges but does depend on user interaction. CISA's SSVC assessment records exploitation as 'none' and no public exploit code has been identified at time of analysis, so the practical risk is concentrated on users running unpatched Chrome builds; Google has released a fixed version (155.0.8059.84), which is the primary mitigation.
RemediationAI
Vendor-released patch: Chrome 155.0.8059.84 - upgrade to that build or later through Chrome's built-in auto-update mechanism, or by downloading the current stable release, and verify the version in chrome://version afterward; details are in the advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html with the upstream patch under https://issues.chromium.org/issues/569038297. No supported configuration workaround fully removes the exposure: SVG image rendering is on by default and cannot be toggled off via a Chrome enterprise policy, and disabling JavaScript does not help because the flaw is triggered during SVG decoding/rendering rather than script execution. Practical compensating controls until patching completes are to keep Chrome's renderer sandbox and site isolation enabled (default, do not disable), restrict or block access to untrusted web content on high-value endpoints through network/proxy filtering (trade-off: user friction and potential breakage of legitimate sites), and shorten the patch window by enforcing browser version compliance through Chrome Browser Cloud Management or equivalent MDM/EDR policies (trade-off: administrative overhead). Since the bug is a read-only memory disclosure, prioritizing patched endpoints that handle sensitive credentials or data yields the most benefit for the least disruption.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Chromium's Blink rendering engine, which parses and rasterizes SVG (Scalable Vector Graphics), an XML-based vector format that browsers render inline from HTML. Attackers control the SVG markup, its geometry, filters, gradients, and path data, which forces Blink to allocate and walk internal buffers; a bounds-checking defect in that path produces an out-of-bounds read. CWE-119 ('Improper Restriction of Operations within the Bounds of a Memory Buffer') is the assigned root-cause class, consistent with the Chromium 'High' severity label for memory-safety bugs, though the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects only leaked memory with no integrity or availability impact. The CPE entry cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Google Chrome releases below the fixed build are in scope; SVG rendering is enabled by default, so no non-default configuration is required to reach the vulnerable code path.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Remote via crafted web page (AV:N) with no privileges (PR:N) but requires the victim to open the page (UI:R); impact is a partial memory read only, so C:L and I:A:N.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB