CVE-2026-110148
8.8 HIGHPublished 2026-10-13 · Updated 2026-10-15
AI risk analysis
- Summary
- A use-after-free vulnerability in Google Chrome's SVG handling allows remote attackers to execute arbitrary code within the sandboxed browser environment. This critical flaw occurs when processing crafted HTML pages with malicious SVG content.
- Exploitability
- Exploitation requires a user visiting a malicious webpage with crafted SVG content, making it moderately difficult but possible to achieve remote code execution through social engineering.
- Blast radius
- The vulnerability affects all Chrome users on versions prior to 155.0.8059.79, potentially enabling attackers to compromise user systems through web-based attacks.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to Google Chrome version 155.0.8059.79 or later immediately.
rcebrowsermemory-corruption
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-416
Vendors
Products
chrome
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-100805
- CRITICALCVE-2026-109707
- HIGHCVE-2026-109730
- HIGHCVE-2026-100209
- HIGHCVE-2026-100211
- CRITICALCVE-2026-100219
- CRITICALCVE-2026-100800
- CRITICALCVE-2026-100804
Related by shared AI tags and CWE weakness class. Browse the full archive.