{"id":"CVE-2026-110148","published":"2026-10-13T22:17:34.637","lastModified":"2026-10-15T04:18:18.647","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-416"],"vendors":["google"],"products":["chrome"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/570050934","tags":["Permissions Required"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A use-after-free vulnerability in Google Chrome's SVG handling allows remote attackers to execute arbitrary code within the sandboxed browser environment. This critical flaw occurs when processing crafted HTML pages with malicious SVG content.","exploitability":"Exploitation requires a user visiting a malicious webpage with crafted SVG content, making it moderately difficult but possible to achieve remote code execution through social engineering.","blast_radius":"The vulnerability affects all Chrome users on versions prior to 155.0.8059.79, potentially enabling attackers to compromise user systems through web-based attacks.","remediation":"Upgrade to Google Chrome version 155.0.8059.79 or later immediately.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","browser","memory-corruption"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:24:42.102Z"}}