Google Chrome: Use-after-free in Desktop allows code execution in sandbox
Summary
A use-after-free flaw (CWE-416) in the Desktop component of Google Chrome before 155.0.8059.79 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs only to lure a user to a crafted HTML page, so any website a user visits can be a delivery route. The CVSS base score is 8.8; according to CISA SSVC data, automatable is no and technical impact is total.
Affected
- Google Chrome Desktop (Windows, macOS, Linux) prior to 155.0.8059.79
- Ubuntu chromium-browser package: marked not affected (Chromium snap installed instead)
Fixed in
- Google Chrome 155.0.8059.79 or later (Linux)
- Google Chrome 155.0.8059.79 or later, 155.0.8059.80 on Windows and macOS (per third-party reports of the vendor update)
- Debian 12 Chromium: 155.0.8059.79-1~deb12u1
- Chromium snap: refresh to the current build
Workaround
- No workaround needed, because a patch is available. Updating Chrome is the remedy.
- Administrators can control rollout timing with the Chrome Enterprise release channel settings.
Exploitation
- No evidence of in-the-wild exploitation found.
- Not listed in CISA KEV according to a third-party source; check the catalog directly.
- EPSS 0.22% according to a third-party source.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Confirm every Chrome installation runs 155.0.8059.79 or later (155.0.8059.80 on Windows and macOS).
- Confirm Linux systems have the Debian package fix or the refreshed Chromium snap.
- Check the browser version across the fleet, especially on unmanaged devices that stay open for long periods.
- Recheck exploitation status periodically in CISA KEV and the vendor advisories.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker entry 540499008 issues.chromium.org
- OSV: Debian CVE-2026-110162 osv.dev
- Ubuntu Security: CVE-2026-110162 ubuntu.com
- Malwarebytes: Chrome update fixes 37 security flaws www.malwarebytes.com
- Chrome Enterprise release channel documentation support.google.com
- GitHub: third-party CVE tracking issue (EPSS, KEV status) github.com
- SUSE CVE via Vulners: CVE-2026-110162 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:56.
Original description (NVD)
Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.