CVE-2026-110915: Use after free in Compositing
Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 155.0.8059.84
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs to persuade a user to load a crafted HTML page. The issue can then allow arbitrary code execution inside the Chrome sandbox.
Which Chrome versions are affected?
Google Chrome versions prior to 155.0.8059.84 are affected. Updating to 155.0.8059.84 or a later version addresses the affected version range described.
Does exploitation escape the browser sandbox?
The described impact is arbitrary code execution inside the sandbox. The provided information does not state that this vulnerability enables a sandbox escape.