Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTM

Google Chrome2026-10-27 23:16 UTC1 min readRead in

Summary

Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Remediation

Inventory every Google Chrome deployment, including staging.
Upgrade Google Chrome to 156.0.8078.73.
Confirm the running version after the upgrade.

References

CVSS vector

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected versions

Version	Fixed in
– <156.0.8078.73	156.0.8078.73

Weakness

CWE-416

Exploit probability (EPSS)

0.3%

Timeline

2026-10-27Publicly disclosed

Sources

NVD