CVE-2026-118308 in Chrome
Summary
by MITRE • 10/28/2026
Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability described constitutes a critical use-after-free flaw within the Scalable Vector Graphics rendering engine of Google Chrome, specifically affecting versions prior to 156.0.8078.73. This type of memory corruption error arises when the application continues to reference a block of memory after it has been freed or deallocated by the system. In the context of browser security, such flaws are particularly dangerous because they can lead to arbitrary code execution if an attacker can control the data written into that reclaimed memory space before it is reallocated for another purpose. The Chromium project has classified this issue with a High severity rating, reflecting its potential to compromise the integrity and confidentiality of user systems when exploited through malicious web content.
From a technical perspective, the flaw resides in how Chrome handles SVG elements during parsing or rendering operations. When an HTML page containing crafted SVG code is loaded, the browser allocates memory for specific graphical objects. If the lifecycle management of these objects is flawed, it may occur that the underlying memory buffer is released while references to it are still maintained within internal data structures. Subsequent interactions with these dangling pointers allow a remote attacker to manipulate the contents of the freed memory. By carefully crafting the HTML and SVG inputs, an attacker can achieve heap spraying or control flow hijacking techniques, ultimately leading to the execution of arbitrary code outside the browser's sandbox environment. This bypasses standard security mitigations such as address space layout randomization and data execution prevention, which are designed to limit the impact of memory corruption vulnerabilities.
The operational impact of this vulnerability is severe for end-users who browse the web using affected versions of Chrome. A successful exploit allows a remote attacker to execute code with the privileges of the current user, potentially leading to full system compromise. This can result in unauthorized access to sensitive data, installation of malware, or use of the compromised machine as part of a botnet. The attack vector is classified as remote and requires only that the victim visits a maliciously crafted webpage, making social engineering or drive-by download scenarios viable delivery mechanisms for this exploit.
To mitigate the risks associated with this vulnerability, organizations and individual users must ensure that Google Chrome is updated to version 156.0.8078.73 or later immediately upon availability. This update contains patches that correct the memory management logic within the SVG rendering engine, preventing the use of freed pointers. Additionally, security teams should enforce strict browser update policies across all endpoints and consider deploying application whitelisting to restrict the execution of untrusted scripts where possible. Monitoring for indicators of compromise related to heap exploitation techniques can also aid in detecting potential attempts to leverage this flaw before a patch is applied.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-416, which describes use after free conditions that lead to undefined behavior and potential security breaches. In the context of the MITRE ATT&CK framework, this exploit technique falls under Tactic TA0002 Execution and specifically relates to techniques such as Command and Scripting Interpreter or Native API Abuse, depending on how the arbitrary code is ultimately executed post-exploitation. Understanding these mappings helps in categorizing the threat within broader security operations centers for improved detection and response strategies.