EUVD-2026-111469
GHSA-2c8f-q9h8-jg9p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
DeliveryDeliver malicious SVG in HTML
-
ExploitTrigger SVG input-validation flaw
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactAttempt follow-on sandbox escape
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the victim to use a Chrome version prior to 156.0.8078.73 and to load attacker-controlled HTML containing a crafted SVG (UI:R - user interaction is mandatory; no authentication needed). The decisive limiting factor is that successful exploitation yields code execution only 'inside the sandbox' - the renderer sandbox contains the impact, so an attacker needs an additional, separate sandbox-escape vulnerability to compromise the underlying host. No non-default configuration is indicated; the SVG-rendering and HTML-handling paths are default browser functionality. |
| Impact | This is a genuine but moderate-urgency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes network-reachable, low-complexity, unauthenticated exploitation that requires user interaction - the victim must load a crafted HTML page - yielding high confidentiality, integrity and availability impact (base 8.8). Critically, the description states code execution occurs 'inside the sandbox,' meaning this alone does not escape Chrome's renderer sandbox and a separate sandbox-escape bug would be required for full host compromise; this materially lowers real-world impact versus the raw 8.8 score. The signals are internally consistent on low exploitation likelihood: EPSS is 0.21% (11th percentile), the vulnerability is NOT on CISA KEV, and no public exploit code is identified. The vendor priority label is 'this_week,' aligning with a routine-but-prompt Chrome stable-channel patch rather than an emergency. No SSVC decision fields (automatable, technical impact) were supplied, and the CWE-20 (improper input validation) classification plus 'SVG' are the only mechanism hints - the precise trigger is not described in the available sources. Net: patch on a normal expedited cycle; this is not evidence of a high-real-risk-but-low-CVSS anomaly nor of active exploitation. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing a malicious SVG that exploits the SVG input-validation flaw; a user with a vulnerable Chrome version simply visits the page (UI:R) and the attacker gains arbitrary code execution confined to the browser's renderer sandbox. No authentication is required (PR:N). No public exploit code is identified at time of analysis, and the specific trigger mechanism is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Improper input validation in SVG handling in Google Chrome before 156.0.8078.73 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page containing malicious SVG (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Successful exploitation is gated by mandatory user interaction - the victim must open the attacker-supplied page in a vulnerable build - and the resulting code execution is confined to the Chrome sandbox, so full host compromise requires an additional, separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis and the flaw does not appear on CISA KEV; EPSS is 0.21% (11th percentile), and Google rates the Chromium security severity as High with a fix already shipped in the stable channel.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.73 or later via the Stable Channel Update for Desktop published at chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html, then fully restart the browser so the new binary is loaded. No workaround or compensating control is documented in the available sources, and because SVG rendering and HTML handling are default browser functionality with no non-default configuration involved, there is no feature toggle or port restriction that removes exposure while keeping the browser functional - updating is the complete fix per the vendor. Prioritize the rollout this week per the assigned priority label, focusing first on users who routinely open untrusted HTML or attachments; note that until the update lands, exploitation still requires the victim to load the crafted page and yields code execution only inside the renderer sandbox, so an attacker additionally needs a separate sandbox-escape vulnerability to reach the host.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classed as CWE-20 (Improper Input Validation) in the browser's SVG rendering path, which in Chrome is implemented in the Blink engine that parses SVG as an XML-based vector graphics format and resolves its embedded references and scriptable content. Because SVG content is reachable from ordinary HTML pages, an attacker only needs the victim to render a crafted document rather than to install or enable anything; the vulnerability sits in default, always-on browser functionality with no non-default configuration indicated. The assigned vector (PR:N, UI:R) confirms no authentication is required but that user interaction is mandatory, and the scope value of Unchanged with a High integrity/confidentiality impact describes a memory-corruption-class outcome reaching arbitrary code execution. Critically, the advisory scopes the impact to code execution inside the sandbox - the renderer sandbox is expected to contain the consequence, and pivoting to the underlying operating system requires chaining a distinct sandbox escape. The specific malformed SVG construct that defeats validation, and therefore the exact trigger, is not described in the available sources; the Chromium issue tracker entry (issues.chromium.org/issues/575184164) is the restricted reference. Affected builds are tracked under EUVD-2026-111469, and the Chromium security severity is High.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges but required user interaction (UI:R); scope unchanged as code runs within the sandbox; high C/I/A within the renderer, matching vendor description.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
Executive ViewAI
Google Chrome versions prior to 156.0.8078.73 contain a high-severity input validation flaw in SVG rendering that allows a remote attacker to run arbitrary code within the browser's renderer sandbox when a user opens a crafted page. Any workforce member using an unpatched Chrome build is exposed through routine web browsing, making this a broad-reach risk across the organization even though the sandbox limits the blast radius absent a separate escape. Leadership should care because the fix is already available and timely browser patching eliminates the exposure at low cost.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB