PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110922 Google CVE debrief

CVE-2026-110922 debrief based on CVE Program and NVD records. This critical use-after-free vulnerability in Google Chrome's Prerender feature could allow remote attackers to execute arbitrary code inside the sandbox via a crafted HTML page. Defenders managing Chrome deployments should assess exposure and prioritize updating Chrome to version 155.0.8059.84 or later. The vulnerability's severity is critical, with a CVSS score of 8.8, indicating high severity. The CVE record and NVD entry provide details on the vulnerability, emphasizing the need for immediate attention and mitigation.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-15
Original CVE updated
2026-10-16
Advisory published
2026-10-15
Advisory updated
2026-10-16

Who should care

Defenders responsible for managing Google Chrome deployments should assess exposure and prioritize updating Chrome to version 155.0.8059.84 or later.

Why it matters

CVE-2026-110922 is a critical use-after-free vulnerability in Google Chrome's Prerender feature. Defenders managing Chrome deployments should assess exposure, prioritize updates to version 155.0.8059.84 or later, and monitor for suspicious activity. The vulnerability could allow remote attackers to execute arbitrary code inside the sandbox via a crafted HTML page.

  • Remote attackers could execute arbitrary code inside the Chrome sandbox
  • Successful exploitation requires user interaction via a crafted HTML page
  • Defenders need to verify Chrome versions and apply updates
  • Exposure assessment and monitoring for suspicious activity are necessary

Technical summary

A use-after-free vulnerability exists in the Prerender feature of Google Chrome prior to version 155.0.8059.84. This vulnerability could allow a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability is caused by the improper handling of memory, leading to a use-after-free condition. This could lead to arbitrary code execution in the context of the current user. Defenders need to verify Chrome versions and apply updates to version 155.0.8059.84 or later.

Defensive priority

High

Recommended defensive actions

  • Assess exposure of Chrome versions prior to 155.0.8059.84
  • Verify and apply Chrome updates to version 155.0.8059.84 or later
  • Monitor for suspicious activity related to CVE-2026-110922

Evidence notes

The CVE record and NVD entry provide details on a use-after-free vulnerability in Google Chrome's Prerender feature, which could allow remote attackers to execute arbitrary code inside the sandbox.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110922 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110922

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110922 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110922

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.