Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

CVE-2026-118304 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceCVE-2026-118304

CVE-2026-118304

UNKNOWN

Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page

Published Oct 27, 2026

Modified Today

Fix available

Details

Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected Packages

Google Chrome

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1703)Windows 10 (1709)Windows 10 (1803)

Fixed in:

156.0.8078.73

google-chrome

brew

Fixed in:

156.0.8078.73

google-chrome@beta

brew

Fixed in:

156.0.8078.73

google-chrome@dev

brew

Fixed in:

156.0.8078.73

Google Chrome Beta

macOS 12macOS 13macOS 14macOS 15macOS 26

Fixed in:

156.0.8078.73

Google Chrome Dev

macOS 12macOS 13macOS 14macOS 15macOS 26

Fixed in:

156.0.8078.73

com.google.Chrome

macOS 12macOS 13macOS 14macOS 15macOS 26

Fixed in:

156.0.8078.73

com.google.Chrome.beta

macOS 12macOS 13macOS 14macOS 15macOS 26

Fixed in:

156.0.8078.73

com.google.Chrome.dev

macOS 12macOS 13macOS 14macOS 15macOS 26

Fixed in:

156.0.8078.73

References

https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html

https://issues.chromium.org/issues/574101376

https://www.cve.org/CVERecord?id=CVE-2026-118304

Weakness Type (CWE)

Input Validation

Improper Input Validation

Ecosystems(31)

Windows 10 (1507)Windows 10 (1607) / Server 2016 Windows 10 (1703)Windows 10 (1709)Windows 10 (1803)

Timeline

PublishedOct 27, 2026

ModifiedOct 27, 2026