EUVD-2026-116521
GHSA-4p79-wx9w-v3cg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML/SVG page
-
ExploitBrowser renders malicious SVG
-
ExecutionTrigger use-after-free in SVG handling
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled web content containing a crafted SVG in a vulnerable Chrome build (prior to 157.0.8103.38) - this maps to UI:R, so some user interaction (visiting or being redirected to a malicious/compromised page) is mandatory and is the primary limiting factor. No authentication or prior privileges are needed (PR:N), and default Chrome configurations are affected. A significant practical limit is that successful exploitation grants code execution only inside the renderer sandbox (S:U); converting this into full system compromise requires chaining with a separate sandbox-escape vulnerability. The specific SVG feature or object lifecycle that triggers the use-after-free is not detailed in the available sources. |
| Impact | This is a genuine priority but not a drop-everything emergency, and the signals are largely consistent. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity memory-corruption flaw requiring no privileges but one user action. Crucially, the description states code executes 'inside the sandbox' - meaning this alone yields renderer-process compromise, not full host takeover, which would require chaining with a separate sandbox-escape bug; this materially tempers real-world impact versus the raw score. SSVC data aligns with a measured response: Exploitation=none (no observed attacks), Automatable=no (user interaction gates mass exploitation), Technical Impact=total (full control of the vulnerable renderer). There is no CISA KEV listing and no EPSS score was provided, so no quantitative exploitation-probability signal is available - this is a data gap, not evidence of low risk. The vuln.today decision label is 'this_week,' consistent with a patched, high-severity browser bug under active patch-gap pressure rather than emergency active exploitation. Net: patch within the normal browser update cycle (prompt, this week), treating it as serious but not currently weaponized. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing a crafted SVG payload and lures a victim into visiting it (phishing link, malvertising, or compromised site). When the victim's Chrome renders the SVG, the use-after-free is triggered, allowing the attacker to execute arbitrary code within the browser's renderer sandbox. No public exploit was identified at the time of analysis; full host compromise would require pairing this with a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
A use-after-free in Google Chrome's SVG rendering code allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page containing malicious SVG content, affecting Chrome builds prior to 157.0.8103.38. Exploitation requires user interaction with attacker-controlled web content (UI:R) but no authentication (PR:N), and any code execution obtained is confined to the sandbox unless chained with a separate sandbox-escape flaw. No confirmed active exploitation or public exploit code has been identified, exploitation is not automatable per SSVC, and a vendor patch is available - the issue is rated this_week priority rather than an emergency.
RemediationAI
Upgrade Google Chrome to version 157.0.8103.38 or later; the vendor patch is available and this is the only complete fix, distributed through the Chrome stable channel update described at https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html. Enterprise fleets should push the update via their browser management tooling and verify the reported version, and users of Chromium-derived browsers should apply the corresponding upstream release once their vendor ships it. Because the flaw is triggered by rendering attacker-supplied SVG content, restricting the browser to trusted sites until the update lands reduces exposure but is not a substitute for patching, and it carries the operational cost of breaking legitimate web workflows; note that even successful exploitation remains inside the renderer sandbox, so keeping the browser current also limits the value of any sandbox-escape chain.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's SVG implementation, a memory-safety error class in which a heap object is freed while a reference to it remains live, letting an attacker reallocate the freed memory with controlled data and redirect execution. SVG is an XML-based vector graphics format processed by Blink's rendering pipeline, and its object graph, animation and layout lifecycles are a recurring source of lifetime bugs; the specific SVG feature or object lifecycle that triggers this use-after-free is not described in the available sources, so only the memory-corruption class and the SVG attack surface can be stated with confidence. The vulnerability is reachable purely through web content - a crafted HTML page embedding the malicious SVG - and Chrome's multi-process architecture confines the resulting code execution to the renderer sandbox (scope unchanged, S:U), meaning full system compromise requires chaining with a distinct sandbox escape. Google rates the issue High via Chromium security severity, and it maps to CPE cpe:2.3:a:google:chrome with a wildcard version, consistent with all builds below the fixed release.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges but required victim interaction (UI:R); sandbox-contained code execution keeps scope unchanged (S:U) with full renderer C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 157.0.8103.38 contain a high-severity use-after-free vulnerability in SVG rendering that could allow remote code execution within the browser sandbox when a user visits a malicious webpage. Although no active exploitation or public exploit code has been identified, the widespread use of Chrome across the organization means that unpatched endpoints remain at risk. Leadership should prioritize patching to prevent potential service disruption, data compromise, or reputational damage from a future exploit.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB