Google Chrome: Improper input validation in SVG
Summary
Google Chrome before 156.0.8078.73 contains an input validation flaw in its SVG handling. A remote attacker can craft an HTML page that may execute arbitrary code inside the browser sandbox. The attack requires the victim to open the malicious page, and Chromium rates the issue High, not Critical.
Affected
- Google Chrome prior to 156.0.8078.73 (per the CNA description)
- The CVE record's affected range is inconsistent and reads "156.0.8078.73 to < 156.0.8078.73"; the description is used here
- Chromium-based browsers such as Microsoft Edge: depends on their own releases, not confirmed
- Ubuntu chromium-browser packages: listed as not affected because they install a Snap
Fixed in
- Chrome 156.0.8078.73 (Linux), 156.0.8078.73 or .74 (Windows and Mac), per the Chrome Stable update of 27 October 2026 as reported by secondary sources
- A later Chrome 156 build (reported as 156.0.8078.79 or .80) exists according to a secondary report, not yet verified on the Chrome Releases blog
- Chrome for Android: 156.0.8078.73 reported
- ChromeOS: no fixed build confirmed; Unknown.
- Microsoft Edge: fix in preparation, no release confirmed
Workaround
None found. Updating the browser is the fix.
Exploitation
- Not known to be exploited in the wild (per OffSeq, snapshot of 26 October 2026)
- Not listed in CISA KEV in the sources reviewed; check the catalog directly
- No public proof-of-concept or exploit code indexed
- EPSS 0.26 % (very low)
Our recommendation
- Check the Chrome version on all endpoints, including Edge and other Chromium-based apps, and update to at least 156.0.8078.73, preferably the latest 156 build
- Enforce browser auto-update by policy
- Check ChromeOS devices and Chrome-based kiosks or embedded apps, which may lag behind updates, and apply updates once Google publishes them
- Re-check the Chrome Releases blog and the CISA KEV catalog for changes
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- OffSeq Radar: CVE-2026-118315 radar.offseq.com
- VulDB: CVE-2026-118315 vuldb.com
- Ubuntu Security: CVE-2026-118315 ubuntu.com
- ChromeGeek: Chrome 156 security update www.chromegeek.com
- Sandbanks Digital: Chrome security update October 2026 sandbanksdigital.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:01.
Original description (NVD)
Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.