Live › vulnerability › CVE-2026-118304
Go to dashboardGoogle Chrome before 156.0.8078.73 mishandles input validation in its SVG code, so a crafted HTML page can make a remote attacker run arbitrary code inside the browser sandbox. Chromium rates the flaw High severity.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 23:29 UTC. All times on this page are UTC.
Any user who opens untrusted web pages in Google Chrome before 156.0.8078.73 is exposed, since the attack needs only a crafted HTML page. Managed fleets and shared workstations should be checked, because the flaw does not depend on an account or special setting. Teams that only run Chrome in a locked-down kiosk with a fixed version, or that use a different browser, can skip it.
No product ranges from the sources yet.
156.0.8078.73 or later.google-chrome --version on Linux or check the installed version on managed fleets.156.0.8078.73 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-118304")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.