CVE-2026-110167 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome deployments should assess exposure and prioritize patching to version 155.0.8059.79 or later. This includes IT teams managing Chrome installations, security teams monitoring vulnerability disclosures, and operators responsible for maintaining browser updates. Vulnerability management and security teams should review the CVE and NVD records for additional context.

Why it matters

CVE-2026-110167 is a use-after-free vulnerability in Google Chrome's Media component that could allow remote code execution inside the sandbox. Defenders should prioritize patching Chrome to version 155.0.8059.79 or later and assess exposure for users with versions prior to the fixed version.

• Potential for remote code execution inside the sandbox
• Requires patching to prevent potential exploitation
• Defenders must verify Chrome version in use and update if necessary
• Exposure assessment necessary for users with Chrome versions prior to 155.0.8059.79

Technical summary

A use-after-free vulnerability exists in the Media component of Google Chrome prior to version 155.0.8059.79. This vulnerability could allow a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability is considered High severity by Chromium security. Defenders should prioritize patching Google Chrome to version 155.0.8059.79 or later, and assess exposure for users who access Chrome with versions prior to the fixed version. The CVE Program and NVD records provide source-grounded information on this vulnerability.

Defensive priority

Defenders should prioritize patching Google Chrome to version 155.0.8059.79 or later, and assess exposure for users who access Chrome with versions prior to the fixed version.

Recommended defensive actions

• Patch Google Chrome to version 155.0.8059.79 or later
• Assess exposure for users with Chrome versions prior to 155.0.8059.79
• Verify Chrome version in use and update if necessary
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD records confirm the existence of a use-after-free vulnerability in Google Chrome's Media component. However, details on exploitation are limited. Defenders should verify Chrome version in use and update if necessary. The CVE record and NVD detail page provide official source information for this vulnerability. Supplemental sources may offer additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.