PatchSiren cyber security CVE debrief

CVE-2026-110154 Google CVE debrief

CVE-2026-110154 debrief based on CVE Program and NVD records. Google Chrome users should assess exposure to version 155.0.8059.79 or earlier. The CVE record was published on 2026-10-13T21:01:47.825Z and has not been modified since then. A use-after-free vulnerability exists in the Canvas component of Google Chrome prior to version 155.0.8059.79. This vulnerability could potentially allow remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. Google Chrome users, particularly those with high-risk exposure to untrusted HTML content, should assess their exposure and update to the latest version. The CVE record and NVD entry indicate a use-after-free in

Vendor: Google
Product: Chrome
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-13
Original CVE updated: 2026-10-15
Advisory published: 2026-10-13
Advisory updated: 2026-10-15

Who should care

Google Chrome users, particularly those with high-risk exposure to untrusted HTML content, should assess their exposure and update to the latest version. This includes users with high-risk exposure to crafted HTML pages and those who use Google Chrome for critical systems. Defenders should prioritize updating Chrome to version 155.0.8059.79 or later and monitor for suspicious activity related to crafted HTML pages.

Why it matters

CVE-2026-110154 is a high-severity use-after-free vulnerability in Google Chrome's Canvas component. Defenders should prioritize updating Chrome to version 155.0.8059.79 or later and monitor for suspicious activity related to crafted HTML pages.

Potential for arbitrary code execution within the sandbox
Possible exploitation via crafted HTML pages
Need for version updates and monitoring

Technical summary

A use-after-free vulnerability exists in the Canvas component of Google Chrome prior to version 155.0.8059.79. This vulnerability could potentially allow remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. The vulnerability has a high severity and defenders should prioritize updating Chrome to version 155.0.8059.79 or later. The CVE record and NVD entry indicate a use-after-free in Google Chrome's Canvas component prior to version 155.0.8059.79. This could allow remote attackers to execute arbitrary code within the sandbox via crafted HTML pages. Defenders should verify the official CVE record and NVD entry for more information.

Defensive priority

High

Recommended defensive actions

Review and update Google Chrome to version 155.0.8059.79 or later
Monitor for suspicious activity related to crafted HTML pages
Implement sandboxing and isolation for critical systems
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry indicate a use-after-free vulnerability in Google Chrome's Canvas component prior to version 155.0.8059.79. This could allow remote attackers to execute arbitrary code within the sandbox via crafted HTML pages. The vulnerability has a high severity and defenders should prioritize updating Chrome to version 155.0.8059.79 or later and monitor for suspicious activity related to crafted HTML pages. Defenders should verify the official CVE record and NVD entry for more information. The CVE Program and NVD have

Sources and references

Verified primary and authoritative sources

CVE-2026-110154 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-110154

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-110154 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110154

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-110154
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110154.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html

Supplemental source
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/570167920

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.