Google Chrome: Memory corruption in DOM allows sandboxed code execution
Summary
Google Chrome before 155.0.8059.84 contains a memory corruption flaw in the DOM (CWE-119). A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires that a user visits the malicious page. The vulnerability has a CVSS score of 8.8 (High) and Chromium rates it as High severity.
Affected
- Google Chrome desktop versions before 155.0.8059.84 (per the CVE description).
- Secondary sources list Windows, Mac and Linux builds as affected; not verified against the vendor advisory.
- Ubuntu lists its chromium-browser package as not affected because it is a snap wrapper.
- Other Chromium-based browsers (Edge, Brave, Opera) must be checked against their own release notes.
Fixed in
- Google Chrome 155.0.8059.84 (Linux), and 155.0.8059.84 or 155.0.8059.85 (Windows and Mac) per secondary sources, released 15 October 2026.
- The Chrome Releases stable channel post lists the fix, but the exact build numbers for this CVE could not be verified against it.
Workaround
- No vendor-documented workaround. Update and fully restart the browser.
Exploitation
- No known exploitation. Google's release table lists the CVE as "Not exploited"; CISA SSVC data shows Exploitation: none and Automatable: no.
- Not listed in CISA KEV according to a GitHub tracker.
- No public proof of concept found. Google restricts bug details until most users have updated.
Our recommendation
- Inventory all Chrome and Chromium-based browser installations on staff devices.
- Confirm that Chrome is at least 155.0.8059.84 (or the matching build for your channel).
- Restart browsers after updating, since auto-updates can take days or weeks.
- Do not rely on auto-update alone for managed devices.
- Check Chrome 156 or newer as well, because a separate critical DOM memory corruption (CVE-2026-119267) affects versions up to 156.0.8078.73.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Google Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker 567638392 issues.chromium.org
- Ubuntu CVE page CVE-2026-110913 ubuntu.com
- OpenCVE CVE-2026-110913 app.opencve.io
- GBHackers: Chrome 155 security flaws gbhackers.com
- SecurityOnline: Chrome security update 155.0.8059.84 securityonline.info
- Chrome Geek: Chrome 155 stable security update www.chromegeek.com
- VulDB CVE-2026-119267 (related Chrome DOM flaw) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:13.
Original description (NVD)
Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.