Live › vulnerability › CVE-2026-118315
Go to dashboardGoogle Chrome before 156.0.8078.73 mishandles input validation in SVG rendering, so a crafted HTML page can execute code inside the browser sandbox. Chromium rates it High severity; the sources do not say whether a full sandbox escape is also possible.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 23:29 UTC. All times on this page are UTC.
Any user or machine running Google Chrome older than 156.0.8078.73 is exposed, because the flaw is reached by simply loading a crafted HTML page. Systems that only run a fixed, updated Chrome or use a different browser do not need action for this issue.
No product ranges from the sources yet.
chrome://version in Chrome and compare the version with 156.0.8078.73156.0.8078.73 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-118315")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.