EUVD-2026-100655
GHSA-cmmm-p9q6-4x7m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML/SVG page
-
ExploitTrigger use-after-free in SVG parser
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load a crafted HTML page containing malicious SVG content in a vulnerable Chrome build prior to 155.0.8059.79 (UI:R - user interaction via navigation to attacker content). No authentication, no privileges, and no non-default configuration are needed; default Chrome installations are affected. Key limiting factors: the attacker cannot act without victim interaction (visiting the page), and resulting code execution is confined to the renderer sandbox (Scope:Unchanged), so full host compromise additionally requires a separate sandbox-escape vulnerability. |
| Impact | Signals are largely consistent and point to a genuinely serious client-side flaw, but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated memory-corruption bug that only requires the victim to open a crafted HTML page. That matches the CWE-416 use-after-free description. However, CISA's SSVC decision framework reports Exploitation: none and Automatable: no, and there is no CISA KEV listing and no public exploit identified at time of analysis, so this is not currently confirmed as exploited. Technical Impact is rated total, consistent with arbitrary code execution. One important nuance tempers the raw 8.8: the description explicitly states code executes 'inside the sandbox' (Scope:Unchanged), meaning a successful exploit yields renderer-process code execution and would still require a separate sandbox-escape to achieve full host compromise - the CVSS C:H/I:H/A:H reflects renderer-context impact, not host takeover. Net: a real patch-priority item for any Chrome fleet given ubiquity and low attack complexity, but absent KEV/POC evidence it is not under active mass exploitation, and the sandbox constraint reduces single-bug blast radius. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious SVG markup and lures a victim into visiting it (phishing link, malvertising, or watering-hole), satisfying the required user interaction. When Chrome's renderer parses the crafted SVG it triggers a use-after-free, giving the attacker arbitrary code execution within the renderer sandbox. No public proof-of-concept or active exploitation has been identified at time of analysis, so this remains a theoretical-but-credible chain pending a sandbox escape for full compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Use-after-free in SVG rendering in Google Chrome versions prior to 155.0.8059.79 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page containing malicious SVG content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416). Exploitation requires user interaction - the victim must navigate to attacker-controlled content - but no credentials or non-default configuration are needed, so default desktop installations are affected; the resulting code execution is confined to the renderer process, meaning full host compromise would additionally require a separate sandbox-escape bug. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), and no public exploit identified at time of analysis; EPSS data was not provided. Google rates the issue Chromium security severity High and has released a stable-channel fix.
RemediationAI
Upgrade to Google Chrome 155.0.8059.79 or later; the vendor-released patch is documented in the Chrome stable-channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html), with the corresponding Extended Stable build in https://chromereleases.googleblog.com/2026/10/extended-stable-update-for-desktop_0571684596.html - verify the exact build number in the advisory before mass deployment, since enterprise-managed Extended Stable channels lag the main stable release. Reload all running browser processes after updating so stale renderer processes are not left in memory, and, if Chrome auto-update is disabled by policy, push the package manually or re-enable updates. Because exploitation requires the victim to load a crafted page and lands only inside the renderer sandbox, the highest-value compensating controls while patching are to keep the renderer sandbox and Site Isolation enabled (disabling either for legacy web apps removes the main containment layer that limits this bug to in-sandbox code execution) and to use enterprise URL blocklists or DNS/proxy filtering to block untrusted or newly registered domains; these reduce exposure but break access to legitimate content and are not a substitute for the patch. Note that disabling SVG entirely is not a supported Chrome setting, so no reliable configuration workaround exists - treat prompt patching as the only effective mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Chrome's SVG implementation, the in-browser parser and renderer for Scalable Vector Graphics. Use-after-free means a heap object - in this case likely a DOM/SVG layout or animation-related node owned by the renderer - is freed while a reference to it remains, and a later access through that dangling pointer reads or writes memory the attacker can influence. Because Blink (Chromium's rendering engine) is written in C++ without memory safety, an attacker who controls the lifetime of the freed object through crafted markup can shape heap layout and pivot the corruption into controlled code execution within the renderer process. SVG is an attractive target class because it combines XML parsing, scripting, animation timing, and complex object graphs, giving many paths to mismatched free/use ordering. The CVSS vector confirms remote network reachability, low attack complexity, no privileges required, and user interaction required (PR:N/UI:R), with full confidentiality, integrity, and availability impact to the renderer (C:H/I:H/A:H) but scope unchanged (S:U), consistent with an in-sandbox compromise. The affected technology stack is Google Chrome and by extension other Chromium-derived browsers that have not yet backported the fix; the CPE/advisory data identifies the fixed build as Google Chrome 155.0.8059.79.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N; victim must open the page (UI:R); code runs within renderer sandbox so S:U with high renderer-context C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 155.0.8059.79 contain a high-severity use-after-free vulnerability in SVG rendering that allows a remote, unauthenticated attacker to execute code within the browser's renderer sandbox when a user visits a malicious page. Although exploitation requires user interaction and code execution is confined to the renderer process, a successful attack could compromise data confidentiality and integrity, and combined with a separate sandbox-escape could lead to broader host compromise. Default desktop installations across the organization are at risk, and a vendor patch is available; timely remediation is critical to reduce exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB