Description
Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-10-02
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free vulnerability in the SVG parser of Google Chrome versions before 154.0.8037.97 permits a remote attacker to execute arbitrary code inside the browser sandbox through a specially crafted HTML page. This flaw, categorized as CWE‑416, enables attackers to run code with the limited permissions of the browser’s sandbox environment, potentially compromising the client system or user data if the sandbox is escaped.

Affected Systems

The bug affects Google Chrome across all platforms (Windows, macOS, Linux) for versions earlier than 154.0.8037.97. Users running any older build are vulnerable until they install a later release that includes the fix.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, indicating no publicly known exploits. The attack vector is inferred to be a malicious web page that a user visits; the attacker can embed crafted SVG content within that page to trigger the use‑after‑free. Exploitation requires that the victim open the malicious page, meaning the risk is mitigated by user behavior and browser update status.

Generated by OpenCVE AI on October 2, 2026 at 22:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Chrome update (at least 154.0.8037.97).
  • Ensure all devices run the patched version by using enterprise update management tools.
  • If updating is delayed, limit exposure by restricting SVG rendering via a content security policy or by disabling the feature through Chrome flags.

Generated by OpenCVE AI on October 2, 2026 at 22:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Use after free in SVG
References
Metrics threat_severity

None

 threat_severity

Important

Mon, 05 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Fri, 02 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Title Use‑after‑free in Chrome SVG Parser Enables Remote Code Execution

Fri, 02 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 02 Oct 2026 18:15:00 +0000

Type Values Removed Values Added
Title Use‑after‑free in Chrome SVG Parser Enables Remote Code Execution

Fri, 02 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 02 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Description Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-03T03:55:39.438Z

Reserved: 2026-09-30T23:12:14.123Z

Link: CVE-2026-103622

cve-icon Vulnrichment

Updated: 2026-10-02T17:41:41.219Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-02T16:16:43.290

Modified: 2026-10-05T15:06:37.423

Link: CVE-2026-103622

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-02T16:07:55Z

Links: CVE-2026-103622 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T22:30:19Z

Weaknesses