EUVD-2026-100630
GHSA-649j-xxwf-32pg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitLoad malicious SVG markup
-
ExecutionTrigger use-after-free in SVG
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open a crafted HTML page containing malicious SVG content in a vulnerable Chrome desktop build (any version prior to 155.0.8059.79, covering both Stable and Extended Stable channels) - this user-interaction requirement (UI:R) is the primary limiting factor and means no server-side or passive network exploitation is possible. No authentication or special privileges are needed (PR:N). A critical scope limitation: the description specifies code execution occurs 'inside the sandbox' (S:U), so an attacker achieves only renderer-process compromise and would require an additional, separate sandbox-escape vulnerability to execute code on the underlying host. |
| Impact | All signals point to a genuine high-priority defect rather than a CVSS-inflated non-issue, but with one important caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) describes a network-reachable, low-complexity, unauthenticated flaw that only requires the victim to open a page, and the Chromium team independently rated it Critical. The SSVC decision framework, however, lists Exploitation: none and Automatable: no, while confirming Technical Impact: total. This is not in CISA KEV and no public exploit has been identified, so despite the alarming severity rating the real-world exploitation signal is currently low. EPSS was not provided in the input and cannot be cited. One nuance to flag explicitly: the description states code execution occurs 'inside the sandbox' (Scope:Unchanged, S:U), meaning a successful attacker gains renderer-process code execution but would still need a separate sandbox-escape chain to fully compromise the host - the C:H/I:H/A:H rating reflects impact within the sandboxed renderer. Net assessment: patch promptly as a memory-corruption bug in ubiquitous software, but note no active exploitation is confirmed today. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page containing malicious SVG content and lures a victim running a vulnerable Chrome build (prior to 155.0.8059.79) to visit it, e.g. via a phishing link or malicious ad. When the page renders, the SVG triggers a use-after-free (CWE-416) that the attacker leverages to execute arbitrary code within the renderer sandbox. No public exploit code has been identified at time of analysis, so this remains a plausible but not-yet-demonstrated scenario. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Use-after-free in Google Chrome's SVG rendering path allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page, affecting all desktop builds prior to 155.0.8059.79 on both the Stable and Extended Stable channels. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), and because the scope is unchanged (S:U) the attacker gains renderer-process code execution, not host compromise, unless the primitive is chained with a separate sandbox escape. Chromium rates the flaw Critical, but all available exploitation signals are currently negative: CISA's SSVC assessment records Exploitation: none, and no public exploit code has been identified at time of analysis. Google has released a vendor patch in Chrome 155.0.8059.79.
RemediationAI
The primary fix is to upgrade Google Chrome to 155.0.8059.79 or later - vendor-released patch version 155.0.8059.79 - which Google documents in its Stable channel update advisory (chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html); organizations that pin users to the Extended Stable channel should apply the matching extended-stable build described in the companion advisory (chromereleases.googleblog.com/2026/10/extended-stable-update-for-desktop_0571684596.html), since both channels are affected by the pre-155.0.8059.79 range. Those running Chromium-derived browsers should track their vendor's release containing the same upstream Blink fix, as no third-party advisory is provided in this feed. Because the defect is a memory-safety issue in SVG parsing, there is no clean feature-level workaround - disabling SVG entirely via an enterprise extension or content-blocking policy would neutralize the attack path but breaks inline SVG icons and graphics on a large share of modern sites, and disabling JavaScript would break most web applications; both should be treated only as temporary, high-cost stopgaps. Keep the renderer sandbox and Site Isolation enabled, since the assessed scope is unchanged (S:U) and the sandbox is precisely what limits this bug to renderer-process code execution rather than host compromise - disabling it would materially worsen impact. If immediate fleet-wide patching is not possible, reduce exposure by constraining risky browsing paths (blocking unexpected HTML attachments at the mail/web gateway reduces the chance a user opens a crafted page, though it is not a substitute for patching), restricting which untrusted HTML runs in embedded webviews, and prioritizing the update on high-value endpoints. Given a Critical Chromium severity rating and the CISA SSVC technical-impact assessment of 'total' alongside Exploitation: none, patching should proceed on a prompt, risk-based schedule rather than as an emergency incident response, and no public exploit code has been identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-416, use-after-free, in the code that parses and renders Scalable Vector Graphics (SVG) content within Chromium's Blink rendering engine. SVG is an XML-based vector graphics format that Chrome handles as a full DOM subtree, with its own element types, animation, filter, and referencing semantics; this complexity creates many object-lifetime edges where a DOM node, layout object, or filter buffer can be released while a reference or animation still holds it. When a dangling pointer is subsequently dereferenced during rendering or script interaction, the freed memory can be reclaimed with attacker-influenced data, converting a memory-safety bug into a controlled read/write primitive that is exploitable for arbitrary code execution with the privileges of the renderer process. The CVSS vector confirms the attacker needs no credentials (PR:N) but must convince a victim to load the malicious page (UI:R) and, critically, that the security scope is unchanged (S:U) - meaning the compromise is confined to the sandboxed renderer rather than the underlying operating system. Google's advisory tags the issue as Remote Code Execution, Denial of Service, and memory corruption, and the Chromium issue tracker entry 570050934 tracks the underlying defect. The relevant technology stack is Chrome/Chromium desktop (Blink) on the Stable and Extended Stable channels, and, by extension, any Chromium-derived browser that inherits the same Blink code until it ships the corresponding upstream fix - although no such third-party advisories are present in the supplied data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N; victim must open the page so UI:R; code runs within the renderer sandbox so S:U with full in-sandbox C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
A use-after-free flaw in Google Chrome's SVG rendering engine (CVE-2026-110148) could allow an attacker to run malicious code when an employee simply opens a crafted web page in an unpatched browser, affecting all desktop Chrome installations below version 155.0.8059.79 on the Stable and Extended Stable channels. Code execution is confined to the browser's renderer sandbox, so impact is limited unless the attacker chains a separate sandbox escape, and no public exploit code or active exploitation has been identified at time of analysis. Given Chrome's near-universal presence across the workforce, rapid patching remains a low-cost, high-value risk reduction for the organization.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB