PatchSiren cyber security CVE debrief

CVE-2026-110172 Google CVE debrief

CVE-2026-110172 debrief based on CVE Program and NVD records. Google Chrome versions prior to 155.0.8059.79 are affected by a use-after-free vulnerability in the Media component. This CVE was published on 2026-10-13T21:01:46.148Z and was last modified on 2026-10-15T03:56:18.062Z. The vulnerability could allow remote attackers to execute arbitrary code inside the sandbox via a crafted HTML page. Defenders should assess exposure and prioritize updating to version 155.0.8059.79 or later. The CVE Program and NVD records confirm the vulnerability and provide additional details.

Vendor: Google
Product: Chrome
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-13
Original CVE updated: 2026-10-15
Advisory published: 2026-10-13
Advisory updated: 2026-10-15

Who should care

Defenders responsible for managing Google Chrome deployments should assess exposure and prioritize updating to version 155.0.8059.79 or later. The vulnerability could allow remote attackers to execute arbitrary code inside the sandbox via a crafted HTML page. Defenders should verify Google Chrome versions and update to 155.0.8059.79 or later. The CVE Program and NVD records confirm the vulnerability and provide additional details.

Why it matters

CVE-2026-110172 is a use-after-free vulnerability in Google Chrome's Media component that could allow remote attackers to execute arbitrary code inside the sandbox. Defenders should prioritize updating Google Chrome to version 155.0.8059.79 or later. Evidence is based on official CVE Program and NVD records.

Remote attackers may execute arbitrary code inside the sandbox
Defenders must verify Google Chrome versions and update to 155.0.8059.79 or later
Exposure requires verification from official sources

Technical summary

A use-after-free vulnerability exists in the Media component of Google Chrome prior to version 155.0.8059.79. This vulnerability could allow a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability is addressed in version 155.0.8059.79 or later. Defenders should prioritize updating Google Chrome to version 155.0.8059.79 or later to address the use-after-free vulnerability in the Media component. The CVE Program and NVD records provide additional details on the vulnerability.

Defensive priority

Defenders should prioritize updating Google Chrome to version 155.0.8059.79 or later to address the use-after-free vulnerability in the Media component.

Recommended defensive actions

Update Google Chrome to version 155.0.8059.79 or later
Verify that Google Chrome is up-to-date
Monitor Google Chrome for any suspicious activity
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD records confirm a use-after-free vulnerability in Google Chrome's Media component. The vulnerability is addressed in version 155.0.8059.79 or later. Evidence is based on official CVE Program and NVD records. Defenders should verify Google Chrome versions and update to 155.0.8059.79 or later. The vulnerability could allow remote attackers to execute arbitrary code inside the sandbox via a crafted HTML page.

Sources and references

Verified primary and authoritative sources

CVE-2026-110172 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-110172

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-110172 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110172

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-110172
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110172.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html

Supplemental source
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/568719352

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.