CVE-2026-110164 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome deployments, particularly in environments where exposure to untrusted HTML content is possible, should assess the vulnerability and update Chrome to the latest version.

Why it matters

CVE-2026-110164 is a high-severity use-after-free vulnerability in Google Chrome's DOM. Defenders should prioritize updating Chrome to version 155.0.8059.79 or later, especially in environments exposed to untrusted HTML content.

• Potential for remote code execution inside the sandbox
• Exposure to crafted HTML pages could lead to arbitrary code execution
• High severity rating from Chromium

Technical summary

A use-after-free vulnerability exists in the DOM of Google Chrome prior to version 155.0.8059.79. This could potentially allow remote attackers to execute arbitrary code inside the sandbox via a crafted HTML page. The Chromium security severity of this issue is rated High. The vulnerability has been publicly disclosed and defenders should review the official advisory for more information. There is no evidence of exploitation in the wild, but defenders should still prioritize updating Chrome to the latest version. The vulnerability affects Google Chrome versions prior to 155.0.8059.79 and defenders should assess the vulnerability and update Chrome to the latest version.

Defensive priority

High

Recommended defensive actions

• Update Google Chrome to version 155.0.8059.79 or later
• Review and monitor HTML page inputs for potential crafted attacks
• Implement sandboxing and isolation for critical systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD records indicate a use-after-free vulnerability in Google Chrome's DOM, with a known affected version prior to 155.0.8059.79. Chromium security severity is rated High. The vulnerability has been publicly disclosed and defenders should review the official advisory for more information. There is no evidence of exploitation in the wild, but defenders should still prioritize updating Chrome to the latest version.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.