CVE-2026-110138: Use After Free

Q: Who is exposed to this issue?

Chrome installations running a version earlier than 155.0.8059.79 are affected. Exploitation requires that the attacker has already compromised the renderer process.

Q: What is required for an attacker to escape the sandbox?

After compromising the renderer process, the attacker can use a crafted HTML page to trigger the use-after-free in ShapeDetection and execute arbitrary code outside the sandbox.

Q: What version addresses the issue?

Update Google Chrome to version 155.0.8059.79 or later.

Published Oct 13, 2026

Updated

Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected Software

1 affected component

Google Chrome<155.0.8059.79

Event History

Oct 13, 2026

CVE Published

via MITRE·09:01 PM

Data Sourced

via MITRE·09:01 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Chrome installations running a version earlier than 155.0.8059.79 are affected. Exploitation requires that the attacker has already compromised the renderer process.

What is required for an attacker to escape the sandbox?

After compromising the renderer process, the attacker can use a crafted HTML page to trigger the use-after-free in ShapeDetection and execute arbitrary code outside the sandbox.

What version addresses the issue?

Update Google Chrome to version 155.0.8059.79 or later.