CVE-2026-110140: Google Chrome V8 RCE Vulnerability

CVE-2026-110140 Overview

CVE-2026-110140 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome. The flaw affects all Chrome desktop builds prior to version 155.0.8059.79. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. Google rated the Chromium security severity as High. The vulnerability is tracked under [CWE-843: Access of Resource Using Incompatible Type (Type Confusion)].

Critical Impact
Remote attackers can achieve arbitrary code execution inside the Chrome renderer sandbox through a single crafted web page, enabling drive-by exploitation at scale.

Affected Products

Google Chrome Desktop (Windows, macOS, Linux) prior to 155.0.8059.79
Chromium-based browsers embedding vulnerable V8 builds prior to version 155
Applications bundling the affected V8 engine for JavaScript execution

Discovery Timeline

2026-10-13 - CVE-2026-110140 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110140

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. Type confusion occurs when code accesses a resource using a type incompatible with the one originally allocated. In V8, this class of bug typically allows an attacker to treat one object as a different object layout. The result is out-of-bounds memory access or arbitrary read and write primitives inside the renderer process. Attackers chain these primitives into arbitrary code execution within the Chrome sandbox. Full escape from the sandbox requires an additional vulnerability, but renderer compromise alone exposes browsing session data, authentication cookies, and cross-origin content.

Root Cause

The root cause is a type confusion defect [CWE-843] in V8's handling of JavaScript objects. V8 performs aggressive just-in-time (JIT) optimization based on inferred object shapes and types. When type assumptions used by optimized code do not match the actual runtime object type, the engine operates on memory with incorrect field offsets or sizes. Public details are limited while the Chromium issue tracker entry #562038980 remains restricted, consistent with Google's standard disclosure practice.

Attack Vector

Exploitation requires an attacker-controlled HTML page and user interaction limited to visiting the page. No authentication is required. Delivery vectors include phishing links, malicious advertisements, compromised legitimate sites, and watering-hole campaigns. The crafted page serves JavaScript that triggers the type confusion in V8, builds read and write primitives, and executes shellcode in the renderer process. See the Google Chrome Stable Update advisory for the official vendor notice.

Detection Methods for CVE-2026-110140

Indicators of Compromise

Chrome renderer processes (chrome.exe --type=renderer) spawning unexpected child processes or shell interpreters
Outbound connections from Chrome renderer processes to unfamiliar hosts shortly after navigation to a new URL
Renderer process crashes with V8-related stack frames preceding anomalous activity
Deployed Chrome versions below 155.0.8059.79 reported by endpoint inventory

Detection Strategies

Monitor browser process trees for anomalous child-process creation originating from renderer processes
Flag Chrome binaries reporting versions prior to 155.0.8059.79 across managed endpoints
Correlate web proxy logs with endpoint telemetry to identify users visiting URLs that immediately precede renderer anomalies
Hunt for JavaScript delivery patterns consistent with V8 exploitation, including heavy use of typed arrays, array buffer manipulation, and JIT-triggering loops

Monitoring Recommendations

Ingest browser process telemetry and DNS resolution logs into a centralized data lake for cross-source correlation
Alert on Chrome renderer processes attempting file writes outside standard profile and cache directories
Track Chrome version drift across the fleet and prioritize endpoints running vulnerable builds for remediation

How to Mitigate CVE-2026-110140

Immediate Actions Required

Update Google Chrome to version 155.0.8059.79 or later on all Windows, macOS, and Linux endpoints
Restart Chrome on all endpoints after the update to ensure the patched V8 engine is loaded
Update Chromium-based browsers and embedded web runtimes as vendors release aligned patches
Audit endpoint inventory to confirm no managed systems remain on vulnerable Chrome builds

Patch Information

Google released the fix in the Chrome Stable channel update to version 155.0.8059.79. Refer to the Google Chrome Stable Update advisory for the official release notes. Enterprise administrators should push the update through Chrome Browser Enterprise, Microsoft Intune, Jamf, or equivalent management tooling. The upstream fix is tracked in Chromium issue #562038980.

Workarounds

Disable JavaScript for untrusted sites using Chrome Enterprise policies if immediate patching is not feasible
Restrict browsing to a vetted allowlist of business-critical domains in high-risk environments
Enable Chrome's Site Isolation and strict Enhanced Safe Browsing policy to raise the exploitation bar
Deploy web content filtering to block known malicious domains and newly registered domains serving executable JavaScript payloads

bash

# Verify installed Chrome version on Linux and macOS endpoints
google-chrome --version
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Windows: query the installed Chrome version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Expected output must report version 155.0.8059.79 or later