Google Chrome: Use-after-free in SVG allows code execution in sandbox
Summary
Google Chrome desktop builds before 156.0.8078.47 contain a use-after-free vulnerability (CWE-416) in the SVG component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires that the user opens the page, and the CVSS score is 8.8 (High).
Affected
- Google Chrome desktop prior to 156.0.8078.47 (Linux and Android per vendor data)
- Windows and macOS: builds prior to 156.0.8078.47 or 156.0.8078.48
- Related Chromium-based products such as Microsoft Edge before 156.0.4314.42 may be affected
Fixed in
- Google Chrome 156.0.8078.47 (Linux, Android)
- Google Chrome 156.0.8078.47 or 156.0.8078.48 (Windows, macOS)
- Microsoft Edge 156.0.4314.42 or later
Workaround
No workaround documented. Update to the fixed version and restart the browser.
Exploitation
- No known exploitation in the wild at the time of research
- No public proof-of-concept found
- CISA SSVC: exploitation none, automatable no, technical impact total
Our recommendation
- Verify that all Chrome desktop installs are at 156.0.8078.47 or later (Windows and macOS: 156.0.8078.48 where shown)
- Verify that Microsoft Edge and other Chromium-based browsers are at 156.0.4314.42 or later
- Restart the browser on all endpoints so the fix takes effect
- Check Linux distribution packages and snaps against their own security trackers
- Prioritise this update for office endpoints because web browsing is a plausible attack route
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue 572862424 issues.chromium.org
- VulnCheck/Vulners CVE record CVE-2026-113339 vulners.com
- Ubuntu CVE tracker CVE-2026-113339 ubuntu.com
- Microsoft Edge multiple vulnerabilities (HKCERT) www.hkcert.org
- Chrome 156 security update (CyberSecurityNews) cybersecuritynews.com
- VulDB entry 424669 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:51.
Original description (NVD)
Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.