CVE-2026-110137 Google CVE debrief

Who should care

Google Chrome users, particularly those with Chrome installations prior to version 155.0.8059.79, should assess exposure and apply updates as necessary. IT administrators responsible for Chrome deployments should review and apply the update to prevent potential sandbox escapes. Security teams should monitor for indicators of compromise and review Chrome configurations for potential vulnerabilities. Chrome users who rely on WebRTC for communication or other

Why it matters

CVE-2026-110137 is a high-severity use-after-free vulnerability in WebRTC in Google Chrome prior to 155.0.8059.79. Defenders should prioritize updating Chrome and assessing exposure to ensure sandbox protection.

• Remote attackers may execute arbitrary code inside the Chrome sandbox
• Chrome users may be vulnerable to sandbox escapes or code execution
• Defenders should prioritize updating Chrome to version 155.0.8059.79 or later
• Exposure assessment and inventory checks are necessary for Chrome deployments

Technical summary

A use-after-free vulnerability in WebRTC in Google Chrome prior to 155.0.8059.79 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This issue is caused by improper handling of WebRTC objects, leading to a potential crash or code execution. The vulnerability is rated as high severity and has been patched by Google in version 155.0.8059.79 or later. Chrome users should update to the latest version to mitigate this risk. No CVSS score is available, but defenders should prioritize this update.

Defensive priority

High

Recommended defensive actions

• Review and apply Google Chrome updates to version 155.0.8059.79 or later
• Assess exposure of Chrome installations to version 155.0.8059.79 or earlier
• Monitor Chrome release notes and security advisories for future updates
• Verify Chrome version in use and compare to the patched version
• Check for any indicators of compromise in Chrome logs
• Perform a thorough review of Chrome configurations and settings
• Consider implementing additional monitoring for suspicious Chrome activity

Evidence notes

The CVE record and NVD entry indicate a use-after-free vulnerability in WebRTC in Google Chrome prior to 155.0.8059.79. Official sources do not provide CVSS scores or exploit details. The vulnerability was reported by external researchers and patched by Google. Chrome users should verify their version and apply updates as necessary. Limited information is available on potential exploitation, but defenders should assume possible sandbox escapes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.