CVE-2026-110917 in Chrome
Summary
by MITRE • 10/16/2026
Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified involves a critical memory corruption flaw within the Scalable Vector Graphics rendering engine of Google Chrome, specifically affecting versions prior to 155.0.8059.84. This defect allows for arbitrary read access to process memory when an attacker successfully lures a user into loading a maliciously crafted HTML page containing specially constructed SVG content. The severity is classified as High by the Chromium security team due to the potential for significant data exfiltration and further exploitation chains stemming from unauthorized memory reads.
From a technical perspective, this issue stems from improper handling of memory allocation or bounds checking within the SVG parser or renderer components. When processing complex vector graphics definitions, the browser may fail to correctly validate offsets or lengths associated with internal data structures. This oversight enables an attacker to craft input that causes the application to read beyond intended buffer boundaries. Unlike write-based vulnerabilities which can lead to code execution, this specific flaw facilitates information disclosure by allowing the reading of arbitrary memory locations. The attack vector is remote and requires user interaction in the form of visiting a compromised or maliciously hosted webpage, making it a classic cross-site scripting adjacent scenario where the payload is delivered via rich media content rather than script injection alone.
The operational impact of this vulnerability centers on confidentiality loss. An attacker leveraging this flaw could potentially read sensitive data residing in the browser process memory space. This may include session cookies, authentication tokens, private keys stored in memory during cryptographic operations, or other user-specific information loaded by web applications running within that context. In advanced exploitation scenarios, such as those involving side-channel attacks like Spectre variants, reading arbitrary memory can be used to infer secrets from adjacent processes or kernel space if the browser has elevated privileges or access through specific APIs. The ability to read memory also aids in defeating security mitigations such as Address Space Layout Randomization by leaking pointer addresses, thereby facilitating subsequent exploitation steps that require precise knowledge of memory layout.
This vulnerability aligns with Common Weakness Enumeration category CWE-125, which describes Out-of-bounds Read vulnerabilities where software reads data past the end or before the beginning of the intended buffer. In terms of offensive security frameworks, this behavior is consistent with techniques found in MITRE ATT&CK under Data from Local System, specifically memory dumping or reading processes to gather intelligence for further lateral movement or privilege escalation. The attack relies on social engineering elements typical of drive-by download campaigns where users are tricked into visiting malicious sites hosting the exploit code within SVG tags embedded in HTML documents.
Mitigation strategies primarily involve immediate patching by upgrading Google Chrome to version 155.0.8059.84 or later, which contains the necessary fixes for memory management errors in the SVG component. For organizations unable to update immediately due to compatibility concerns, implementing strict content security policies can help mitigate risks by restricting the loading of external resources and preventing inline scripts that might facilitate more complex exploitation chains. Additionally, deploying browser isolation technologies such as Microsoft Edge InPrivate mode or sandboxing solutions like Sandboxie can limit the impact if a vulnerability is successfully exploited by containing the attack within an isolated environment with restricted access to sensitive host memory. Regular security awareness training for users regarding suspicious links and untrusted web content remains a critical defense layer against this type of remote exploitation attempt.