CVE-2026-110149 Google CVE debrief

Who should care

Google Chrome users, particularly those with version 155.0.8059.79 or earlier, should assess exposure and verify the latest version. Chrome users may be vulnerable to exploitation. Verification of Chrome version is necessary. Updating to the latest version is recommended. Security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-110149 is a use after free vulnerability in Google Chrome that allows remote attackers to execute arbitrary code outside the sandbox. Chrome users, particularly those with version 155.0.8059.79 or earlier, should assess exposure and verify the latest version to prevent potential exploitation.

• Remote attackers may execute arbitrary code outside the sandbox
• Chrome users may be vulnerable to exploitation
• Verification of Chrome version is necessary
• Updating to the latest version is recommended

Technical summary

A use after free vulnerability in Google Chrome prior to version 155.0.8059.79 allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. This vulnerability has a high severity and is a use after free issue. Chrome users, particularly those with version 155.0.8059.79 or earlier, should assess exposure and verify the latest version to prevent potential exploitation. The vulnerability is caused by a use after free issue in the Browser component of Google Chrome. The CVE record was published on 2026-10-13T21:01:39.768Z and has not been modified since then.

Defensive priority

High priority for Chrome users to verify and update to the latest version.

Recommended defensive actions

• Verify and update Google Chrome to the latest version
• Assess exposure to version 155.0.8059.79 or earlier
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail page provide official information about the vulnerability. Google Chrome versions prior to 155.0.8059.79 are affected. The vulnerability has a high severity and is a use after free issue. The CVE record was published on 2026-10-13T21:01:39.768Z and has not been modified since then. The NVD vulnerability detail page provides additional information about the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.