EUVD-2026-105423
GHSA-m5wj-p226-2cqf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
ExploitBrowser parses malicious SVG content
-
ExecutionTrigger use-after-free in SVG handling
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use an affected Chrome build (any desktop/ChromeOS version prior to 156.0.8078.47) and to load attacker-controlled HTML containing a crafted SVG payload - i.e., CVSS UI:R user interaction (visiting a page) is mandatory; there is no server-side or passive trigger. No authentication or privileges are needed (PR:N). The key limiting factor is that successful code execution is confined to the renderer sandbox (S:U, 'inside the sandbox' per vendor), so full host compromise additionally requires chaining a separate sandbox-escape vulnerability; sites using strict content handling that never render the malicious SVG would also not trigger the bug. |
| Impact | This is a genuine high-priority patch item. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw that only requires a victim to view a crafted HTML page - a trivially met condition for a web browser. The CWE-416 use-after-free class is historically the most reliably exploitable Chrome bug type. However, the signals are not uniformly alarming: there is no CISA KEV listing and no public exploit code or EPSS score supplied in the input, so active exploitation is NOT confirmed. Critically, Google's own text states code execution occurs 'inside the sandbox,' and the vector carries S:U (scope unchanged), meaning this single bug does NOT by itself achieve a sandbox escape to the host - it would typically need to be chained with a second sandbox-escape primitive for full host compromise. Net assessment: real priority due to ubiquity and exploitability of the bug class, but the raw 8.8 somewhat overstates standalone impact because sandbox containment limits blast radius absent a chain. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious SVG markup and lures a victim into visiting it (phishing link, malvertising, or a watering-hole site). When Chrome renders the SVG, a use-after-free is triggered, giving the attacker arbitrary code execution within the renderer sandbox. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in SVG rendering in Google Chrome before 156.0.8078.47 allows a remote attacker to execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The issue is rated CVSS 8.8 with UI:R, so exploitation requires user interaction such as visiting attacker-controlled content; no public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later, then restart all browser processes so the new build is active. ChromeOS users should apply the corresponding stable-channel update described at http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01150416531.html, and desktop users should follow https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. No fully effective workaround was identified in the provided data; until patching is complete, reduce exposure by blocking or sanitizing untrusted SVG/HTML at mail and web gateways (side effect: may break legitimate SVG content), enforcing strict site isolation, and avoiding opening untrusted HTML pages in affected Chrome builds. Keep the renderer sandbox enabled, since the assessed impact is code execution inside the sandbox and host compromise would require an additional sandbox-escape vulnerability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a CWE-416 use-after-free in Chrome's SVG handling. A freed object remains referenced during SVG processing, and a crafted HTML page containing malicious SVG can corrupt renderer memory and redirect execution. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms remote reachability without privileges, but requires the victim to load attacker-controlled content. Because the scope is unchanged and the vendor states code execution is 'inside the sandbox,' the impact is confined to the renderer process; full host compromise would require chaining a separate sandbox-escape flaw. The affected component is Chrome's Blink/SVG rendering stack, and the Chromium issue tracker entry 572862424 provides the upstream bug context.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs victim interaction (UI:R, PR:N) and the UAF yields code execution confined to the sandbox, so scope is unchanged (S:U) with full renderer-context C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome endpoints face a high-severity code-execution risk through crafted SVG content, requiring only a user to open a malicious page; successful abuse could undermine browser isolation on affected workstations. Leadership should care because Chrome is widely deployed and reachable through normal web browsing, though no public exploit or confirmed active exploitation was identified at time of analysis and Google has released a fixed build.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB