CVE-2026-110136 Google CVE debrief

Who should care

Google Chrome users, particularly those with versions prior to 155.0.8059.79, should assess exposure and update to the latest version. This includes Chrome users in managed environments, security teams, and operators who use Chrome for critical tasks. Chrome users should urgently assess exposure and update to the latest version to prevent potential exploitation. The vulnerability affects Google Chrome prior to version 155.0.8059.79 and can be exploited via

Why it matters

CVE-2026-110136 is a critical vulnerability in Google Chrome that allows remote attackers to execute arbitrary code outside the sandbox. Chrome users should urgently assess exposure and update to the latest version to prevent potential exploitation.

• Remote code execution outside the sandbox
• Potential for arbitrary code execution
• Need for urgent patching and verification

Technical summary

A use after free vulnerability in PDF in Google Chrome prior to 155.0.8059.79 allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. This vulnerability is critical and requires immediate attention from Chrome users. The vulnerability affects Google Chrome prior to version 155.0.8059.79 and can be exploited via a crafted HTML page. Chrome users should urgently assess exposure and update to the latest version to prevent potential exploitation. The technical details of the vulnerability are based on the CVE Program and NVD records.

Defensive priority

High priority for Chrome users to verify and update to the latest version.

Recommended defensive actions

• Verify and update Google Chrome to the latest version
• Assess exposure to vulnerable versions
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail page provide official information about the vulnerability. Google Chrome versions prior to 155.0.8059.79 are affected. The CVE record was published on 2026-10-13T21:01:39.987Z and has not been modified since then. This information is based on the CVE Program and NVD records, which are considered reliable sources for vulnerability information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.