Executive brief
Google Chrome is a widely used web browser. A security vulnerability in how the browser handles Scalable Vector Graphics (SVG) images could allow a malicious website to execute unauthorized code on a user's computer. While this code execution is restricted by the browser's security sandbox, it represents a significant risk to user data and system integrity if combined with other flaws.
Technical details
A use-after-free (UAF) vulnerability exists in the SVG processing component of Google Chrome. The flaw is triggered when the browser incorrectly manages memory for SVG elements, allowing an attacker to reference memory after it has been freed. By enticing a user to visit a malicious website or view a crafted HTML page, a remote attacker can exploit this condition to achieve arbitrary code execution (ACE). Although the execution is confined within the Chromium renderer sandbox, it provides a critical foothold for further exploitation. The vulnerability is addressed in Google Chrome version 148.0.7778.216 and later.
Affected products
- Google Chrome prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Stable channel update released for Windows, Mac, and Linux.
- 2026-05-28: disclosed: CVE record published.