PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110155 Google CVE debrief

A buffer overflow vulnerability in PDFium in Google Chrome prior to 155.0.8059.79 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This issue is considered High severity by Chromium. The CVE record was published on 2026-10-13T21:01:48.049Z and was last modified on 2026-10-15T03:56:28.666Z. Defenders responsible for Google Chrome deployments should assess and prioritize patching to prevent potential code execution risks. The vulnerability's impact is limited to the sandbox environment, reducing the risk of system compromise.

Vendor
Google
Product
Chrome
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-13
Original CVE updated
2026-10-15
Advisory published
2026-10-13
Advisory updated
2026-10-15

Who should care

Defenders responsible for Google Chrome deployments, especially those exposed to untrusted web content, should assess and prioritize patching to prevent potential code execution risks.

Why it matters

CVE-2026-110155 is a High-severity buffer overflow vulnerability in PDFium in Google Chrome that allows remote code execution inside the sandbox. Defenders should prioritize patching and monitoring to address potential risks.

  • Remote code execution inside the sandbox requires verification of patch deployment.
  • Exposure to untrusted web content increases risk of attack.
  • Defenders must monitor for indicators of compromise.
  • Patch verification and deployment are critical.

Technical summary

The buffer overflow vulnerability in PDFium in Google Chrome prior to 155.0.8059.79 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This issue is considered High severity by Chromium. The vulnerability is caused by a lack of proper bounds checking in the PDFium library, which can lead to a buffer overflow when processing maliciously crafted HTML pages. The vulnerability can be mitigated by applying the patch and ensuring that the secure version of Google Chrome is deployed.

Defensive priority

Defenders should prioritize verifying and applying the patch to ensure the secure version of Google Chrome is deployed, focusing on systems and users exposed to untrusted web content.

Recommended defensive actions

  • Verify and apply the patch to ensure the secure version of Google Chrome (155.0.8059.79 or later) is deployed.
  • Assess exposure of Google Chrome installations to untrusted web content.
  • Monitor Google Chrome systems for indicators of compromise.
  • Review and update incident response plans to address potential code execution risks.
  • Perform a thorough review of system logs to detect any potential malicious activity.
  • Implement additional security measures such as network segmentation and access controls.
  • Conduct regular security audits to ensure compliance with organizational security policies.

Evidence notes

The CVE record and source item provide details on the buffer overflow vulnerability in PDFium in Google Chrome. The Chromium security severity is rated as High. The affected version is Google Chrome prior to 155.0.8059.79.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110155 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110155

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110155 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110155

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2026-110155

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110155.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://issues.chromium.org/issues/570167922

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.