CVE-2026-110156: Incorrect reference resolution in Extensions
Chromium CVE-2026-110156: Incorrect reference resolution
Other sources
Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)
— MITRE
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 155.0.8059.79 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 155.0.4283.60 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 152.0.4191.135 - Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 155.0.8059.79
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-110152
- CVE-2026-110149
- CVE-2026-110136
- CVE-2026-110161
- CVE-2026-110165
- CVE-2026-110148
- CVE-2026-110151
- CVE-2026-110162
- CVE-2026-110170
- CVE-2026-110160
- CVE-2026-110143
- CVE-2026-110146
- CVE-2026-110150
- CVE-2026-110137
- CVE-2026-110140
- CVE-2026-110158
- CVE-2026-110145
- CVE-2026-110159
- CVE-2026-110144
- CVE-2026-110153
- CVE-2026-110166
- CVE-2026-110169
- CVE-2026-110168
- CVE-2026-110139
- CVE-2026-110172
- CVE-2026-110164
- CVE-2026-110163
- CVE-2026-110141
- CVE-2026-110138
- CVE-2026-110157
- CVE-2026-110147
- CVE-2026-110154
- CVE-2026-110155
- CVE-2026-110167
- CVE-2026-110171
- CVE-2026-110142
Frequently Asked Questions
Who is exposed to this issue?
Chrome installations on Mac running versions earlier than 155.0.8059.79 are affected. Exploitation also requires the attacker to have already compromised the renderer process and to use a crafted Chrome extension.
Is this exploitable through normal web content alone?
The available information does not describe a web-content-only attack. It states that the attacker must first compromise Chrome’s renderer process, after which the crafted extension can be used to execute code outside the sandbox.
What is the remediation?
Update Google Chrome on Mac to version 155.0.8059.79 or later.