Google Chrome: Use-after-free in Core component allows code execution
Summary
A use-after-free flaw (CWE-416) in the Core component of Google Chrome on Android before 155.0.8059.79 can be exploited by a remote attacker. A crafted HTML page can potentially execute arbitrary code outside the browser sandbox. The NVD CVSS score is 9.6 (critical), and the vendor rates the Chromium security severity as Critical.
Affected
- Google Chrome on Android prior to 155.0.8059.79 (per NVD description)
- Scope on other platforms is unclear: a secondary source lists the fix among desktop Core fixes, which the vendor advisory could not be checked to confirm
Fixed in
- Android: 155.0.8059.79 (secondary sources; a later Android build 155.0.8059.84 is reported to carry the same fixes)
- Desktop: 155.0.8059.79/.80 (Windows and Mac), 155.0.8059.79 (Linux), according to secondary sources
- Confirm exact versions against the Chrome Releases advisory
Workaround
- Unknown. No vendor-issued workaround was found; updating is the remedy.
Exploitation
- No evidence of exploitation in the wild found.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- No public proof of concept found.
- Details of the Chromium bug are not publicly accessible.
Our recommendation
- Update Chrome on Android to 155.0.8059.79 or later, preferably the latest stable build.
- Check desktop Chrome installations and update them to the latest stable release as well.
- Enforce automatic browser updates via your mobile device management or endpoint tools.
- Verify the installed versions after the update.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker 568827293 issues.chromium.org
- OSV: DEBIAN-CVE-2026-110165 osv.dev
- Malwarebytes: Chrome fixes 37 security flaws www.malwarebytes.com
- Cybersecurity News: Multiple Google Chrome vulnerabilities cybersecuritynews.com
- CVE Brief archive, October 2026 cvebrief.com
- GitHub Advisory GHSA-cfcv-cjw8-r6j8 github.com
- CVE Threatint: CVE-2026-110165 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:50.
Original description (NVD)
Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.