CVE-2026-110917: Google Chrome Information Disclosure Flaw

CVE-2026-110917 Overview

CVE-2026-110917 is a memory corruption vulnerability in the Scalable Vector Graphics (SVG) component of Google Chrome prior to version 155.0.8059.84. A remote attacker can read process memory by convincing a user to visit a crafted HTML page. Chromium rates the internal severity as High, while the National Vulnerability Database (NVD) assigns a medium rating because the flaw requires user interaction and only impacts confidentiality. The weakness is classified under CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer.

Critical Impact
Remote attackers can leak sensitive in-process memory from the renderer, including data that may support bypassing Address Space Layout Randomization (ASLR) in follow-on exploitation.

Affected Products

Google Chrome for Desktop prior to 155.0.8059.84
Chromium-based browsers that embed the vulnerable SVG rendering code
Downstream distributions pinned to pre-155 Chrome builds

Discovery Timeline

2026-10-15 - CVE-2026-110917 published to the NVD
2026-10-19 - Last updated in the NVD database
2026-10 - Google releases the Stable Channel desktop update addressing the issue

Technical Details for CVE-2026-110917

Vulnerability Analysis

The vulnerability resides in Chrome's SVG rendering pipeline. A crafted HTML page containing malformed SVG markup triggers memory corruption that allows the attacker to read memory outside of intended buffer bounds. Because the condition surfaces inside the renderer process, the attacker gains visibility into whatever data lives alongside the SVG parser's working memory. That data can include tokens, cross-origin content retained in the renderer, or address pointers useful for defeating ASLR.

Exploitation requires the victim to load attacker-controlled HTML. No elevated privileges are needed. The impact is limited to information disclosure. Integrity and availability are not directly affected based on the published vector. The flaw aligns with the CWE-119 category, covering improper restriction of operations within a memory buffer. Google and Chromium have not disclosed the specific SVG code path, and no public proof-of-concept exploit is available at the time of writing. The Exploit Prediction Scoring System (EPSS) places near-term exploitation probability in the low single digits.

Root Cause

The root cause is improper bounds enforcement during SVG processing in Blink. The parser or layout code reads beyond an allocated region, exposing adjacent renderer memory to attacker-controlled script.

Attack Vector

The attack vector is network-based. A remote attacker hosts a malicious page or injects SVG into a trusted site. When a user visits the page, the crafted SVG triggers the out-of-bounds read inside the renderer process.

// No verified public proof-of-concept is available.
// See the Chromium issue tracker entry #569038297 for restricted technical details.

Detection Methods for CVE-2026-110917

Indicators of Compromise

Browser crash reports or renderer tab terminations referencing SVG parsing frames
Outbound requests to newly registered domains serving .svg or SVG-embedded HTML to internal users
Chrome versions below 155.0.8059.84 reported by endpoint inventory tools

Detection Strategies

Inventory installed browser versions across managed endpoints and flag Chrome builds older than 155.0.8059.84
Hunt web proxy logs for HTML responses with large embedded SVG payloads from low-reputation hosts
Correlate renderer crash telemetry with recent navigation events to identify suspected exploitation attempts

Monitoring Recommendations

Enable Chrome enterprise reporting to centralize version and crash data
Monitor DNS and proxy logs for anomalous access to domains serving crafted SVG content
Track user-agent strings in web application logs to confirm patched Chrome adoption across the fleet

How to Mitigate CVE-2026-110917

Immediate Actions Required

Update Google Chrome to version 155.0.8059.84 or later on all desktop platforms
Restart browsers after patch deployment so loaded renderer processes pick up the fix
Audit Chromium-based applications and embedded WebViews for the vulnerable version

Patch Information

Google shipped the fix in the Stable Channel desktop update documented in the Google Chrome Desktop Update advisory. Technical tracking is maintained in Chromium Issue #569038297. Administrators should push the update through managed deployment channels and verify version compliance.

Workarounds

Enforce Site Isolation and strict Content Security Policy (CSP) rules that limit inline SVG from untrusted origins
Deploy browser policies that block navigation to uncategorized or newly observed domains until patching completes
Educate users to avoid clicking unsolicited links while the update rolls out

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Example Windows registry check for enterprise-managed Chrome
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv