CVE-2026-110141: Google Chrome Information Disclosure Flaw

CVE-2026-110141 Overview

CVE-2026-110141 is an observable discrepancy vulnerability in the Media component of Google Chrome prior to version 155.0.8059.79. A remote attacker can leak cross-origin data by convincing a user to visit a crafted HTML page. The flaw is classified under [CWE-203: Observable Discrepancy], a side-channel weakness where behavioral differences in processing reveal protected information. Chromium rates the underlying security severity as High, while the NVD CVSS score reflects the user interaction requirement and limited confidentiality impact.

Critical Impact

Successful exploitation allows a remote attacker to bypass the Same-Origin Policy and infer cross-origin resource contents through observable media processing behavior.

Affected Products

• Google Chrome versions prior to 155.0.8059.79 (Stable channel)
• Chromium-based browsers inheriting the vulnerable Media component
• Desktop builds across Windows, macOS, and Linux

Discovery Timeline

• 2026-10-13 - CVE-2026-110141 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110141

Vulnerability Analysis

The vulnerability resides in Chrome's Media subsystem, which handles decoding and processing of audio and video resources loaded from arbitrary origins. An observable discrepancy occurs when the Media component exposes behavioral differences, such as timing variations, error signaling, or state changes, that depend on properties of cross-origin content.

An attacker-controlled page can load cross-origin media resources and measure these discrepancies through standard web APIs. The measurements enable inference of data that the Same-Origin Policy is designed to protect. The vulnerability does not grant direct read access, but allows an attacker to reconstruct protected information through repeated observations.

The CWE-203 classification places this issue in the same family as prior browser side-channel disclosures affecting cache state, pixel data, and codec behavior.

Root Cause

The root cause is insufficient isolation between the Media component's processing path and signals observable to the loading document. When media handling branches on properties of the fetched resource, those branches produce measurable side effects. Attackers exploit these effects to leak information across origin boundaries.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build. The page embeds media elements referencing cross-origin targets and uses scripted observation to measure processing behavior. No authentication is required, and the attack operates fully over the network. See the Chromium Issue #568895734 tracker for further technical context.

The vulnerability mechanism is described in prose only; no verified public proof-of-concept code is available at the time of writing.

Detection Methods for CVE-2026-110141

Indicators of Compromise

• Chrome browser clients reporting versions earlier than 155.0.8059.79 in HTTP User-Agent telemetry or endpoint inventory.
• Repeated outbound requests from browser processes to attacker-controlled pages hosting media elements that reference unrelated internal or authenticated origins.
• Unusual patterns of cross-origin media fetches followed by scripted timing measurements against the same resources.

Detection Strategies

• Inventory browser versions across the fleet and flag endpoints running Chrome builds below 155.0.8059.79.
• Monitor web proxy and DNS logs for user navigation to newly registered or low-reputation domains that embed cross-origin media payloads.
• Correlate browser crash and renderer telemetry with navigation events, since side-channel exploitation often produces anomalous renderer timing or memory signatures.

Monitoring Recommendations

• Ingest browser version telemetry into the SIEM and alert on devices that remain unpatched after a defined grace period.
• Enable Chrome Enterprise reporting for extension installs, downloads, and policy violations to catch exploitation chains.
• Track EPSS trending for CVE-2026-110141 and raise priority if the current EPSS probability of 0.174% rises materially.

How to Mitigate CVE-2026-110141

Immediate Actions Required

• Update Google Chrome to version 155.0.8059.79 or later across all managed endpoints.
• Push the update through enterprise management tooling and force a browser restart to apply the fix.
• Instruct users to avoid clicking links from untrusted sources until the patched build is deployed.

Patch Information

Google addressed the vulnerability in the Chrome Stable channel update documented in the Google Chrome Stable Update release notes. Chromium-based browser vendors should pull the corresponding upstream fix referenced in Chromium Issue #568895734 and ship updated builds to downstream users.

Workarounds

• No vendor-supplied workaround replaces the patch; upgrading is the authoritative remediation.
• Restrict high-risk browsing with web filtering policies that block uncategorized and newly registered domains.
• Enforce site isolation and strict Cross-Origin-Resource-Policy headers on sensitive internal applications to reduce the value of leaked signals.

# Configuration example: enforce minimum Chrome version via Chrome Enterprise policy
# Windows registry key for managed devices
reg add "HKLM\Software\Policies\Google\Chrome" /v MinimumVersion /t REG_SZ /d "155.0.8059.79" /f

# macOS managed preference
defaults write com.google.Chrome MinimumVersion -string "155.0.8059.79"

# Linux policy file: /etc/opt/chrome/policies/managed/min_version.json
# {
#   "MinimumVersion": "155.0.8059.79"
# }