Loading vulnerability…
Memory disclosure in Google Chrome SVG handling
CVE-2026-110917 is a high-severity memory corruption vulnerability in the SVG component of Google Chrome before version 155.0.8059.84. Processing a specially crafted HTML page can allow a remote attacker to read browser memory. The specific vulnerable function and underlying memory corruption mechanism have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises confidentiality by exposing browser memory contents. The specific information accessible to an attacker is not established. Arbitrary code execution, sandbox escape, and integrity or availability impacts are not established for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is specified.
Patch, then assume compromise.
Upgrade Google Chrome to version 155.0.8059.84 or later; the announced macOS fixed release is 155.0.8059.85. For Chromium installations, apply the distribution security update providing version 155.0.8059.84 or later. Restart the browser to activate the update and verify the installed version. Fedora and EPEL update notices additionally require logging out and back in.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.