Loading vulnerability…
Sandboxed code execution via SVG use-after-free in Google Chrome
CVE-2026-110148 is a use-after-free vulnerability in the SVG implementation of Google Chrome versions before 155.0.8059.79. A remote attacker can trigger the vulnerability through a crafted HTML page to execute arbitrary code inside the browser sandbox. Chromium classifies the vulnerability as Critical. The vulnerability does not by itself establish a sandbox escape.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the affected sandboxed browser process, allowing arbitrary code execution within its security constraints. Sandbox escape, operating-system takeover, and privilege escalation are not established outcomes of this vulnerability alone.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Pending patching, restrict access to untrusted web content and use URL filtering to reduce exposure to malicious pages. Preserve browser sandboxing and available exploit protections. These measures do not replace installing the security update.
Patch, then assume compromise.
Upgrade Google Chrome to version 155.0.8059.79 or a later supported release and relaunch the browser to activate the update. For distribution-managed Chromium installations, install the applicable vendor security update. Debian stable (trixie) provides a fixed Chromium package in version 155.0.8059.79-1~deb13u1 or later. Where the installed package is unsupported or has no available fix, migrate to a supported, patched browser.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.