Google Chrome: Use-after-free in Prerender allows code execution in sandbox
Summary
A use-after-free flaw in the Prerender feature of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker only needs to lure a user to a crafted HTML page, for example through a phishing link or a compromised website, and no authentication is required. The CVSS score is 8.8 (HIGH), and Google rates the issue Critical in Chromium. Full compromise would normally also require a sandbox escape, which is not described in the advisory.
Affected
- Google Chrome desktop builds before 155.0.8059.84 (Windows, macOS, Linux)
- Android build affected: unclear, sources differ (155.0.8059.79 or 155.0.8059.84)
- Earliest affected version: Unknown.
- Downstream Chromium-based browsers (e.g. Edge, Brave, Opera) depend on their own vendor's release timing.
- Ubuntu chromium-browser package: listed as not affected (Snap wrapper).
Fixed in
- Chrome 155.0.8059.84 or later (Windows and macOS: 155.0.8059.84/.85 according to secondary sources; Linux: 155.0.8059.84)
- Vendor advisory: Chrome Releases Stable Channel Update for Desktop, 15 October 2026
- Rollout is gradual over days or weeks.
Workaround
- Unknown. No vendor workaround identified; applying the update is the remedy.
Exploitation
- No evidence of exploitation in the wild found.
- Google lists the issue as not exploited; CISA SSVC lists exploitation as none and automatable as no.
- Not listed in CISA KEV as of the research date.
- No public proof of concept found.
- EPSS: 0.00384 (per Vulners).
Our recommendation
- Update Chrome to 155.0.8059.84 or later on all desktop systems, including Android devices if affected.
- Check the browser version across all endpoints and confirm that browsers were restarted after the update.
- Force the update via Chrome's About page where automatic updates are delayed.
- Verify the build of other Chromium-based browsers in use and update them as well.
- Prioritise managed fleets and rarely restarted machines.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
VABISMO/chrome2shell
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Ubuntu CVE tracker ubuntu.com
- GBHackers: Chrome 155 security flaws gbhackers.com
- SecurityOnline: Chrome security update 155.0.8059.84 securityonline.info
- OpenCVE: CVE-2026-110922 app.opencve.io
- Vulners EUVD-2026-102510 vulners.com
- Dijitalturk: Chrome 155.0.8059.84 fixes dijitalturk.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:12.
Original description (NVD)
Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.