EUVD-2026-35214
GHSA-45pg-448j-3rfq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts malicious HTML with crafted SVG
-
DeliveryLure victim via phishing or malvertising
-
ExploitVictim's Chrome loads page and parses SVG
-
ExecutionInappropriate SVG implementation triggers code injection
-
PersistArbitrary code executes inside renderer sandbox
-
ImpactChain with sandbox escape for full host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML containing a crafted SVG payload in a vulnerable Chrome Desktop build prior to 149.0.7827.103 - the CVSS UI:R flag confirms user interaction (visiting the page) is mandatory. No authentication to Chrome or any web service is required (PR:N), and no special non-default Chrome configuration is called out by Google; SVG rendering is enabled by default in all Chrome installations. The principal limiting factor is that successful exploitation yields execution only inside the renderer sandbox (Scope: Unchanged), so converting this into host compromise additionally requires chaining a separate sandbox-escape vulnerability not covered by this CVE. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a network-reachable, low-complexity, unauthenticated attack that nonetheless requires a user to load a malicious page - a realistic prerequisite for any browser drive-by. Patch is available from the vendor and the issue is not currently listed in CISA KEV; no EPSS score, SSVC decision, or public POC was provided in the input, so probability-of-exploitation cannot be quantitatively scored from available data. The bug should be treated as a high-priority patch despite no confirmed in-the-wild activity, because (a) Chromium SVG/renderer RCE bugs historically attract rapid n-day exploit development once the Chromium issue tracker entry (issues.chromium.org/issues/517309206) becomes accessible, and (b) the scope remains Unchanged inside the sandbox, meaning real-world impact ultimately depends on whether attackers can chain a sandbox escape - a meaningful but not automatic limitation. |
| Exploit ScenarioDerived | An attacker hosts (or compromises) a website that serves an HTML page embedding a maliciously crafted SVG document; the victim is lured via phishing, malvertising, or a watering-hole compromise to visit the URL in a vulnerable Chrome build. When Blink parses the SVG, the inappropriate implementation flaw is triggered and the attacker achieves arbitrary code execution inside the renderer sandbox, which in a real intrusion would typically be paired with a separate sandbox-escape bug to pivot to full host compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Sandboxed remote code execution in Google Chrome versions prior to 149.0.7827.103 allows a remote attacker to execute arbitrary code within the renderer sandbox by enticing a user to visit a crafted HTML page that abuses an inappropriate SVG implementation. Google rates the underlying Chromium issue as High severity, and no public exploit identified at time of analysis, though the user-interaction requirement (UI:R) and high CVSS of 8.8 make this a meaningful drive-by browsing risk once a patch is reverse-engineered.
RemediationAI
Upgrade Google Chrome to 149.0.7827.103 or later on the Stable Desktop channel as published in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html); this is the vendor-released patch and is the primary fix. Enterprises managing Chrome via policy should force-restart browsers after auto-update to ensure the patched binary is loaded, since Chrome only activates updates on relaunch. If patching must be deferred, restrict browsing to trusted sites via SmartScreen/SafeBrowsing enforcement and an outbound web proxy allowlist, and consider enforcing the SitePerProcess and IsolateOrigins policies to maximize the value of the renderer sandbox boundary - the trade-off is increased memory usage per tab. Chromium-derived browsers should be updated to their equivalent downstream releases once published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Chrome's SVG (Scalable Vector Graphics) rendering pipeline, which is implemented within the Blink rendering engine and processes complex declarative graphics directly inside the renderer process. The CWE-94 (Improper Control of Generation of Code, i.e., Code Injection) classification combined with the 'inappropriate implementation' language used by Google typically indicates a logic flaw in how SVG content is parsed, validated, or handed to downstream subsystems, allowing attacker-controlled data to influence code execution paths. Because exploitation yields execution 'inside a sandbox' (Scope: Unchanged), the attacker initially gains code execution constrained by Chrome's renderer sandbox rather than full host compromise, though such primitives are commonly chained with separate sandbox-escape bugs in real-world attack chains.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
A critical vulnerability in Google Chrome (CVE-2026-11688, CVSS 8.8) allows remote attackers to execute arbitrary code on employee systems through compromised or malicious websites, without requiring authentication or legitimate user action beyond browsing. Every employee using Chrome versions prior to 149.0.7827.103 faces exposure to drive-by attacks that could lead to data exfiltration, malware deployment, and system compromise. A vendor patch is available and requires immediate enterprise-wide deployment to eliminate this attack vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-94 – Code Injection
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB