Description
Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-10-02
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Exposure via SVG Rendering
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in Google Chrome's SVG rendering engine allows a maliciously crafted SVG element embedded within an HTML document to access the browser's internal data, such as cookies or local storage, thereby exposing sensitive information to a remote attacker. This weakness is classified as CWE‑200 and does not result in denial of service or code execution, but rather in unintended disclosure of data.

Affected Systems

All desktop versions of Google Chrome before 154.0.8037.97 on Windows, macOS, and Linux are affected. The fix was included in later releases, making the issue independent of the underlying operating system.

Risk and Exploitability

The CVSS score of 6.5 indicates medium severity, and the EPSS score is below 1%, implying a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that a remote attacker must host a malicious HTML page containing the crafted SVG and that a user must visit that page while Chrome is running; no additional conditions or public exploits are documented.

Generated by OpenCVE AI on October 7, 2026 at 08:31 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Chrome to version 154.0.8037.97 or a later release.
  • Configure a content‑security‑policy header that disallows or restricts inline SVG or external SVG content from untrusted origins.
  • Implement a network‑level web‑filtering solution capable of detecting and blocking URLs that serve malicious SVG data.

Generated by OpenCVE AI on October 7, 2026 at 08:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Information leak in SVG
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 07 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Title Information Leak via SVG in Google Chrome

Wed, 07 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Tue, 06 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

Fri, 02 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Title Information Leak via SVG in Google Chrome
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 02 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Description Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-200
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-06T17:54:02.596Z

Reserved: 2026-09-30T23:12:19.600Z

Link: CVE-2026-103627

cve-icon Vulnrichment

Updated: 2026-10-02T16:59:43.489Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-02T16:16:43.827

Modified: 2026-10-06T19:12:36.750

Link: CVE-2026-103627

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-02T16:07:56Z

Links: CVE-2026-103627 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T08:45:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor