CVE-2026-10007: Use after free in SVG in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in Google Chrome's SVG rendering engine allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack is reachable over the network and requires no authentication, but does require the victim to visit a crafted HTML page. Successful exploitation gives an attacker code execution within the Chrome sandbox, which can be combined with a sandbox escape to achieve full compromise of the host process. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by luring the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credential of any kind is required; any user browsing to the malicious page is a viable target.

• Victim interactionRequired

  The victim must open the attacker-crafted HTML page, meaning the attack depends on a social-engineering step such as a phishing link or malicious advertisement.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• The attacker gains arbitrary code execution inside the Chrome renderer sandbox, enabling reads of in-memory session tokens, page content, and credentials entered in the browser.
• Attacker-controlled code running in the renderer can modify in-memory DOM state and intercept or tamper with data the user submits to web applications.
• The compromised renderer process can be used as a stepping stone for a secondary sandbox-escape exploit, potentially giving the attacker full control of the host process.
• Confidentiality, integrity, and availability of the browser process are all fully compromised once the exploit lands.