CVE-2026-110160: Google Chrome vulnerability

Q: What conditions are required for exploitation?

An attacker must first compromise the renderer process and then use social engineering to get a user to interact with a crafted HTML page. The issue could then potentially be used to bypass site isolation.

Q: Which Chrome versions need to be updated?

Google Chrome versions before 155.0.8059.79 are affected. Updating to 155.0.8059.79 or later addresses the vulnerable version range described.

Q: Are users protected if they do not interact with attacker-controlled content?

The described attack requires social engineering involving a crafted HTML page, in addition to prior renderer-process compromise. The provided information does not describe exploitation without those conditions.

Published Oct 13, 2026

Updated

Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: High)

Affected Software

1 affected component

Google Chrome<155.0.8059.79

Event History

Oct 13, 2026

CVE Published

via MITRE·09:01 PM

Data Sourced

via MITRE·09:01 PM

DescriptionWeakness

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must first compromise the renderer process and then use social engineering to get a user to interact with a crafted HTML page. The issue could then potentially be used to bypass site isolation.

Which Chrome versions need to be updated?

Google Chrome versions before 155.0.8059.79 are affected. Updating to 155.0.8059.79 or later addresses the vulnerable version range described.

Are users protected if they do not interact with attacker-controlled content?

The described attack requires social engineering involving a crafted HTML page, in addition to prior renderer-process compromise. The provided information does not describe exploitation without those conditions.