CVE-2026-121092
High · 8.8CVSS
8.8
EPSS
0.3%
Published
Nov 3, 2026
CISA due date
—
The record
Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63475 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. CWE-674
- CVE-2026-115290 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via… CWE-674
- CVE-2026-121423 SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows… CWE-674
- CVE-2026-120689 HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in… CWE-674
- CVE-2026-101180 DoS vulnerability in the file parsing module. CWE-674
- CVE-2026-120135 Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. CWE-674
- CVE-2026-62303 Pistache is a high-performance REST toolkit written in C++. CWE-674
- CVE-2026-61847 Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3… CWE-674