CVE-2026-118308: Use After Free
Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Google Chrome versions prior to 156.0.8078.73 are affected. The issue can be triggered remotely through a crafted HTML page.
What does an attacker need to exploit it?
An attacker needs to cause the target to process a crafted HTML page containing the malicious SVG content. The provided information does not indicate any requirement for local access or prior authentication.
What is the potential impact of successful exploitation?
Successful exploitation could allow arbitrary code execution outside of Chrome's sandbox.
How can I determine whether remediation is needed?
Check the installed Google Chrome version. Versions earlier than 156.0.8078.73 require updating based on the affected-version information provided.