EUVD-2026-111458
GHSA-36cj-h7fq-v645
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitDeliver malicious SVG content
-
ExecutionTrigger improper input validation in SVG handling
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the victim to use a vulnerable Google Chrome desktop build prior to 156.0.8078.73 and to open attacker-controlled web content - the CVSS UI:R requirement means the user must load a crafted HTML page containing the malicious SVG; it cannot be triggered without that interaction. No authentication is required (PR:N) and no special non-default Chrome configuration is indicated in the description. The key limiting factor is sandbox containment: per the description and S:U, resulting code execution is confined to the renderer sandbox, so real-world host impact additionally depends on chaining a separate sandbox-escape vulnerability. |
| Impact | Signals point to a genuinely high-severity but not yet urgent browser flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity, unauthenticated code execution that requires user interaction (visiting a crafted page). Critically, the description scopes impact as code execution 'inside the sandbox' and the vector keeps S:U, meaning the attacker is confined to Chrome's renderer sandbox rather than achieving host compromise - a single bug here is typically one link in a chain, not a full host takeover. EPSS is low at 0.22% (13th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, which is consistent with Google's own 'High' (not Critical) Chromium rating. The vuln.today decision label is 'this_week', so this should be patched promptly but is not flagged as emergency. Net: a real priority to patch on a normal browser-update cadence, but current data does not indicate active or imminent widespread exploitation; the headline 8.8 overstates standalone impact because of sandbox containment. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious HTML page containing a crafted SVG that triggers the improper input validation when a victim opens it in a vulnerable Chrome build. Successful exploitation yields arbitrary code execution confined to Chrome's renderer sandbox, which an attacker would normally need to chain with a separate sandbox-escape bug to affect the host. No public exploit code has been identified at time of analysis; the trigger mechanism beyond 'crafted SVG via a crafted HTML page' is not detailed in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Google Chrome desktop builds prior to 156.0.8078.73 mishandle input validation during SVG processing, allowing a remote attacker to achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects a high-severity flaw that requires user interaction and yields code execution confined to the sandbox, so full host compromise would additionally require chaining a separate sandbox-escape bug. No public exploit code has been identified at time of analysis, the EPSS score is low at 0.22% (13th percentile), and the issue is not in CISA KEV; the vendor has released a fix and priority is rated as remediation this week.
RemediationAI
Vendor-released patch: Chrome 156.0.8078.73. Update Google Chrome desktop to 156.0.8078.73 or later, distributed through the stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html; enterprise fleets should push the update via their normal Chrome update mechanism and verify the reported browser version on managed endpoints. No fixed version is listed for other branches in the supplied data, so any downstream Chromium-based browsers should be checked against their own vendor advisories rather than assumed patched. The supplied sources describe no workaround and do not list compensating controls; the remediation path documented here is the vendor update. Note that because exploitation requires the user to open a crafted HTML page, exposure ends once the browser is on the fixed build.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-20 improper input validation defect in Chromium's SVG handling, reachable through ordinary web content rendered by the browser; the Chromium project rates it High severity. Because Chrome renders SVG through Blink in the renderer process, a validation failure on attacker-supplied SVG markup can corrupt renderer state and potentially be steered into arbitrary code execution within that process. The specifics of how the malformed input is constructed and which parsing path is reached are not described in the available sources. The CVSS scope is Unchanged and the description explicitly places the resulting execution inside the sandbox, so the impact model is renderer-level compromise requiring a second, independent sandbox escape for host-level damage. The UI:R metric confirms that the victim must actually open the malicious HTML page; PR:N confirms no credentials are needed, and no non-default Chrome configuration is indicated.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no privileges (PR:N) but requires the victim to open it (UI:R); code execution stays inside the renderer sandbox so scope is unchanged (S:U) with high C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome desktop versions prior to 156.0.8078.73 contain a high-severity input validation flaw in SVG processing that allows remote code execution within the renderer sandbox when a user visits a crafted HTML page. This affects all employees using unpatched Chrome, posing a risk of malware infection or data theft, though host compromise requires an additional sandbox escape. Leadership should prioritize patching this week to prevent potential exploitation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB