PatchSiren cyber security CVE debrief

CVE-2026-110159 Google CVE debrief

CVE-2026-110159 debrief based on the supplied source corpus. The CVE record was published on 2026-10-13T21:01:43.593Z. Google Chrome's Updater has an incorrect authorization issue, allowing local attackers to execute arbitrary code outside the sandbox via a local program. Defenders should verify and apply the patch, review local program interactions, and monitor for suspicious activity. The CVE record has not been modified since its publication date. This issue is considered High severity by Chromium security.

Vendor: Google
Product: Chrome
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-13
Original CVE updated: 2026-10-15
Advisory published: 2026-10-13
Advisory updated: 2026-10-15

Who should care

Defenders responsible for managing Google Chrome installations, especially in environments where local program interactions are common, should assess exposure and apply the patch. This includes IT teams managing Chrome deployments, security teams reviewing vulnerability management, and operators handling local program interactions with Chrome's Updater.

Why it matters

CVE-2026-110159 allows local attackers to execute arbitrary code outside the sandbox in Google Chrome prior to 155.0.8059.79. Defenders should verify and apply the patch, review local program interactions, and monitor for suspicious activity.

Local attackers may execute arbitrary code outside the sandbox.
Defenders must verify and apply patches to prevent exploitation.
Local program interactions with Chrome's Updater require review.

Technical summary

The Updater in Google Chrome prior to 155.0.8059.79 has an incorrect authorization issue, allowing a local attacker to execute arbitrary code outside the sandbox via a local program. This issue is considered High severity by Chromium security. Defenders should prioritize verifying and applying the patch to Google Chrome, focusing on local program interactions, and review compensating controls for exposed systems while remediation is scheduled and verified. Local attackers may execute arbitrary code outside the sandbox, and defenders must verify and apply patches to prevent exploitation.

Defensive priority

Defenders should prioritize verifying and applying the patch to Google Chrome, focusing on local program interactions.

Recommended defensive actions

Verify and apply the patch to Google Chrome
Review local program interactions with Chrome's Updater
Monitor for suspicious local activity
Confirm whether affected Google Chrome installations exist in managed environments and assign an owner for follow-up
Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the incorrect authorization issue in Google Chrome's Updater, allowing local attackers to execute arbitrary code outside the sandbox. The issue is in Google Chrome prior to 155.0.8059.79. Defenders should verify patch application and review local program interactions with Chrome's Updater.

Sources and references

Verified primary and authoritative sources

CVE-2026-110159 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-110159

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-110159 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110159

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-110159
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110159.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html

Supplemental source
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/564573066

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.