Loading vulnerability…
Sandboxed Code Execution in Google Chrome SVG Handling
CVE-2026-118304 is an improper input validation vulnerability in the SVG component of Google Chrome before version 156.0.8078.73. A remote attacker can potentially trigger arbitrary code execution inside the browser sandbox through a crafted HTML page. The vulnerability also affects Chromium-based browsers, including Microsoft Edge. Chromium classifies the vulnerability as High severity. The specific vulnerable function and malformed input conditions are not publicly detailed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could compromise the confidentiality, integrity, and availability of resources accessible within the affected browser sandbox. Arbitrary code execution is potentially possible, but this vulnerability alone does not establish a sandbox escape or unrestricted execution on the host operating system.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Reduce exposure through web filtering and restrictions on untrusted browsing, retain browser sandboxing and available anti-exploitation protections, and run the browser under a non-administrative account. These defense-in-depth measures do not replace installing the security update.
Patch, then assume compromise.
Upgrade Google Chrome to version 156.0.8078.73 or later and relaunch the browser. For Microsoft Edge on Windows, upgrade to version 156.0.4314.58 or later. On Debian 13 (trixie), upgrade Chromium to version 156.0.8078.73-1~deb13u1 or later. For other Chromium-based packages, install the applicable distribution security update incorporating Chromium 156.0.8078.73 or later, observing any package-specific session restart requirements.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.