CVE-2026-110143: Google Chrome lmza_sdk Information Disclosure

CVE-2026-110143 Overview

CVE-2026-110143 is a use-of-uninitialized-variable flaw in the third-party lmza_sdk component bundled with Google Chrome. The issue affects Chrome versions prior to 155.0.8059.79 and allows a remote attacker to potentially read memory inside the sandbox through a crafted file. Google tracks the Chromium security severity as High, while the CVSS v3.1 base score is 4.3. Exploitation requires user interaction, typically opening or processing an attacker-supplied file in the browser. The weakness is classified as [CWE-457: Use of Uninitialized Variable].

Critical Impact
A remote attacker can read uninitialized sandbox memory in Chrome, potentially exposing residual data from previously processed content.

Affected Products

Google Chrome Desktop versions prior to 155.0.8059.79
Chromium-based browsers embedding the vulnerable lmza_sdk third-party component
All platforms (Windows, macOS, Linux) running the affected Chrome Stable channel

Discovery Timeline

2026-10-13 - CVE-2026-110143 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110143

Vulnerability Analysis

The vulnerability resides in the lmza_sdk third-party library integrated into Chrome. The code path reads a stack or heap variable before initialization, exposing residual memory contents to the attacker-controlled parsing context. When Chrome processes a crafted file through the affected SDK, the uninitialized bytes become observable in later computations. An attacker can structure the input so that these bytes influence downstream state the renderer later surfaces. The read occurs inside the renderer sandbox, which limits direct host compromise but still leaks process memory. Chrome's sandbox contains the fault, so this is an information-disclosure issue rather than code execution. The CVSS vector indicates network-reachable exploitation with user interaction required and confidentiality impact only.

Root Cause

The root cause is [CWE-457: Use of Uninitialized Variable] inside lmza_sdk. A code path consumes a buffer or variable before writes populate it, allowing prior memory contents to flow into logic that an attacker can observe. Third-party SDK integrations frequently miss initialization invariants enforced by Chromium's internal coding standards.

Attack Vector

An attacker hosts or delivers a crafted file that Chrome processes through the vulnerable SDK code path. The victim must interact with the content, such as navigating to a page or opening a file that triggers the parser. The uninitialized read then exposes memory from the renderer process back to attacker-reachable state. No privileges are required on the target system.

No verified public proof-of-concept code is available. Technical details are tracked in the Chromium Issue Tracker #554531101 and the Google Chrome Stable Update advisory.

Detection Methods for CVE-2026-110143

Indicators of Compromise

Chrome Stable channel version strings reported below 155.0.8059.79 across managed endpoints
Browser telemetry showing navigation to untrusted sites immediately preceding renderer memory anomalies
Delivery of unexpected archive or compressed media files processed by Chrome prior to patching

Detection Strategies

Inventory installed Chrome builds through endpoint management and flag versions below 155.0.8059.79
Monitor renderer process crashes and anomalous memory read patterns correlated with file downloads
Correlate web proxy logs with Chrome version data to identify at-risk users browsing untrusted content

Monitoring Recommendations

Track Chrome auto-update status across the fleet and alert on stalled or disabled update channels
Ingest browser version telemetry into the SIEM to maintain a continuous compliance view
Watch for exploit chaining attempts that combine information disclosure with secondary renderer bugs

How to Mitigate CVE-2026-110143

Immediate Actions Required

Update Google Chrome to version 155.0.8059.79 or later on all desktop platforms
Restart Chrome after the update to ensure the patched lmza_sdk binary is loaded
Audit Chromium-based third-party browsers for upstream merges that include this fix

Patch Information

Google addressed the issue in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. Users on 155.0.8059.79 or later are no longer exposed to this uninitialized read. Enterprise administrators should force update rollouts through group policy or MDM where auto-update is restricted.

Workarounds

Restrict user navigation to untrusted sites through web proxy or DNS filtering until patching completes
Disable processing of unneeded compressed or archive file types in browser-based workflows
Use site isolation and strict download policies to reduce exposure to crafted files

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Example Windows registry policy to force Chrome auto-update
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f