CVE-2026-110145 Google CVE debrief

Who should care

Google Chrome users, particularly those with exposed or high-risk deployments, should assess their exposure and prioritize updates to mitigate potential risks. This includes operators managing Chrome deployments, platform administrators, vulnerability management teams, and security teams responsible for monitoring and protecting sensitive data and systems.

Why it matters

CVE-2026-110145 is a high-severity use-after-free vulnerability in Google Chrome's Passwords component. Defenders should prioritize updates to prevent potential remote code execution outside the sandbox. Exposure assessment and version verification are crucial for mitigating risks.

• Remote code execution outside the sandbox
• Potential for attacker exploitation
• Need for version verification and updates
• Possible impact on sensitive data and systems

Technical summary

A use-after-free vulnerability exists in the Passwords component of Google Chrome prior to version 155.0.8059.79. This issue allows remote attackers, who have compromised the renderer process, to execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability impacts Google Chrome users, particularly those with exposed or high-risk deployments. Defenders should verify Chrome versions and prioritize updates to mitigate potential risks. The CVE record and NVD entry provide details on the use-after-free vulnerability in Google Chrome's Passwords component.

Defensive priority

High

Recommended defensive actions

• Verify and update Google Chrome to version 155.0.8059.79 or later
• Assess exposure and prioritize updates for affected Chrome deployments
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the use-after-free vulnerability in Google Chrome's Passwords component. The issue is exploitable via crafted HTML pages, allowing remote code execution outside the sandbox.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.