CVE-2026-110142 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome deployments, particularly in environments where remote access or untrusted input is common, should assess exposure and apply updates to mitigate the risk of arbitrary code execution.

Why it matters

CVE-2026-110142 is a use-after-free vulnerability in Google Chrome's FileSystem component that allows remote attackers to execute arbitrary code outside the sandbox. Defenders should assess exposure, apply updates, and monitor for suspicious activity related to crafted HTML pages.

• Remote attackers may execute arbitrary code outside the sandbox
• Defenders must verify Chrome version and update to 155.0.8059.79 or later
• Exposure requires verification from official sources

Technical summary

The CVE-2026-110142 vulnerability is a use-after-free issue in the FileSystem component of Google Chrome prior to version 155.0.8059.79. This vulnerability allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability affects Google Chrome deployments and defenders should assess exposure and apply updates to mitigate the risk of arbitrary code execution. The CVE Program and NVD records indicate a use-after-free vulnerability in Google Chrome's FileSystem component.

Defensive priority

High

Recommended defensive actions

• Assess exposure and apply updates for Google Chrome to version 155.0.8059.79 or later
• Review and update inventory of Chrome deployments to ensure version 155.0.8059.79 or later is installed
• Monitor for suspicious activity related to crafted HTML pages
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE Program and NVD records indicate a use-after-free vulnerability in Google Chrome's FileSystem component. The vulnerability was publicly disclosed on 2026-10-13 and last modified on 2026-10-15.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.