Loading vulnerability…
Sandboxed Code Execution in Google Chrome SVG Processing
CVE-2026-110157 is a high-severity use-after-free vulnerability in the SVG implementation of Google Chrome versions before 155.0.8059.79. A remote attacker can trigger the flaw through a crafted HTML page to execute arbitrary code inside the browser sandbox. Chromium-derived products, including Chromium and Microsoft Edge, also require updates incorporating the upstream fix. The specific vulnerable function and object-lifetime sequence are not publicly detailed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution within the browser sandbox, potentially compromising the confidentiality, integrity, and availability of resources accessible to the affected process. This vulnerability alone does not establish sandbox escape, operating-system compromise, or administrative privileges. Its vulnerability-specific CVSS 3.1 base score is 8.8, with network access, low attack complexity, no required privileges, and required user interaction.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. Until updates are applied, reduce exposure to untrusted web content through URL filtering and restrictions on unnecessary browser functionality and extensions. Retain browser sandboxing and available exploit protections, and run the browser under a non-administrative account. These defense-in-depth measures do not eliminate the vulnerability or replace patching.
Patch, then assume compromise.
Upgrade Google Chrome to version 155.0.8059.79 or a later supported fixed release and relaunch the browser. Update Chromium and related packages through the operating system's supported security channel. Debian fixed versions include 155.0.8059.79-1~deb12u1 for bookworm, 155.0.8059.79-1~deb13u1 for trixie, and 155.0.8059.79-1 for sid; no forky-specific fixed version is identified. Update Microsoft Edge to the latest supported release incorporating the Chromium fix; a vulnerability-specific fixed Edge version is not specified.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.