CVE-2026-110165 Google CVE debrief

Who should care

Android users of Google Chrome, especially those exposed to untrusted web content, should assess their exposure and update to the latest version as a high priority. This includes operators, platform administrators, vulnerability management teams, and security teams who need to evaluate the potential impact on their environments and take appropriate actions to mitigate the risk.

Why it matters

CVE-2026-110165 is a critical use-after-free vulnerability in Google Chrome on Android, potentially allowing remote code execution. Android Chrome users, especially those exposed to untrusted web content, should update to version 155.0.8059.79 or later as a high priority.

• Potential remote code execution outside the sandbox
• Exposure to untrusted web content may increase risk
• Verification of Chrome version and update status is necessary

Technical summary

A use-after-free vulnerability exists in the Core component of Google Chrome on Android prior to version 155.0.8059.79. This issue could potentially allow remote attackers to execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability has a critical severity rating according to Chromium security assessments. Technical details are limited, emphasizing the need for source-grounded assessments and defensive impact evaluations without unsupported root-cause or exploit claims. Affected product context and defensive priorities are highlighted for Android Chrome users.

Defensive priority

High priority for Android Chrome users, especially those exposed to untrusted web content.

Recommended defensive actions

• Update Google Chrome on Android to version 155.0.8059.79 or later
• Restrict exposure to untrusted web content
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Official CVE Program and NVD records confirm the vulnerability in Google Chrome on Android prior to version 155.0.8059.79. The records indicate a critical severity rating and potential for remote code execution outside the sandbox. Limited details on exploitation or impact are provided, emphasizing the need for defenders to verify Chrome version and update status. Evidence limits are acknowledged, and further verification tasks are recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.