CVE-2026-110158 Google CVE debrief

Who should care

Google Chrome users, particularly those with Chrome installations on their systems, should assess their exposure to this vulnerability and take necessary actions to update or mitigate the risk.

Why it matters

CVE-2026-110158 is a high-severity use-after-free vulnerability in Google Chrome's Passwords feature. It allows remote attackers who have compromised the renderer process to execute arbitrary code outside the sandbox. Chrome users should assess exposure and update to version 155.0.8059.79 or later.

• Potential remote code execution outside the sandbox
• Possible exploitation by attackers who have compromised the renderer process
• Need for updating Chrome to version 155.0.8059.79 or later
• Verification of system logs for potential exploitation attempts

Technical summary

A use-after-free vulnerability exists in the Passwords feature of Google Chrome prior to version 155.0.8059.79. This vulnerability could allow a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability is classified as high-severity and affects Google Chrome users. Chrome users should assess exposure and update to version 155.0.8059.79 or later. The CVE record and NVD entry provide details on this vulnerability. The vulnerability allows remote attackers who have compromised the renderer process to execute arbitrary code outside the sandbox.

Defensive priority

High

Recommended defensive actions

• Update Google Chrome to version 155.0.8059.79 or later
• Review system logs for potential exploitation attempts
• Assess exposure of Chrome installations to this vulnerability
• Verify Chrome version in use
• Check for any suspicious activity in system logs
• Perform a security audit of Chrome installations
• Implement compensating controls for exposed systems

Evidence notes

The CVE record and NVD entry provide details on a use-after-free vulnerability in Google Chrome's Passwords feature, which could allow remote code execution outside the sandbox. The vulnerability exists in Google Chrome prior to version 155.0.8059.79. Chrome users should assess exposure and update to version 155.0.8059.79 or later. Evidence is limited to CVE Program and NVD records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.