CVE-2026-110149: Use After Free

Q: What does an attacker need to exploit this issue?

The attacker needs to deliver a crafted HTML page to the target. Exploitation can be performed remotely.

Q: Does successful exploitation remain contained by Chrome's sandbox?

No. Successful exploitation can allow arbitrary code execution outside the Chrome sandbox.

Published Oct 13, 2026

Updated

Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Affected Software

1 affected component

Google Chrome<155.0.8059.79

Event History

Oct 13, 2026

CVE Published

via MITRE·09:01 PM

Data Sourced

via MITRE·09:01 PM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs to deliver a crafted HTML page to the target. Exploitation can be performed remotely.

Does successful exploitation remain contained by Chrome's sandbox?

No. Successful exploitation can allow arbitrary code execution outside the Chrome sandbox.