CVE-2026-110144: Google Chrome Privilege Escalation Flaw

CVE-2026-110144 Overview

CVE-2026-110144 is an incorrect authorization vulnerability in the Mojo inter-process communication (IPC) layer of Google Chrome on Windows. The flaw affects Chrome versions prior to 155.0.8059.79 and allows a local attacker to potentially execute arbitrary code outside the browser sandbox through a local program. Google's Chromium security team rated the issue as High severity. The weakness is classified as [CWE-863: Incorrect Authorization].

Critical Impact
A local attacker leveraging a malicious program on a Windows host can escape the Chrome sandbox and execute arbitrary code in a higher-privileged renderer or broker context, undermining the browser's primary security boundary.

Affected Products

Google Chrome for Windows prior to 155.0.8059.79
Chromium-based builds on Windows that embed the vulnerable Mojo IPC layer
Downstream Chromium derivatives on Windows that have not merged the upstream fix

Discovery Timeline

2026-10-13 - CVE-2026-110144 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110144

Vulnerability Analysis

The vulnerability resides in Mojo, the IPC framework that Chrome uses to broker communication between its sandboxed renderer, GPU, utility, and privileged browser processes. Mojo enforces authorization checks to ensure that only authorized endpoints can invoke privileged interfaces. In the affected Chrome builds on Windows, those checks are performed incorrectly, allowing an unauthorized caller to reach a protected interface.

The practical consequence is a sandbox escape. A local program running on the same Windows host can interact with Chrome's IPC endpoints in a way that bypasses the intended authorization boundary. The CVSS vector indicates user interaction is required, consistent with a scenario where the victim launches or interacts with Chrome while the malicious local program is present.

Root Cause

The root cause is improper enforcement of authorization in the Mojo IPC layer [CWE-863]. The affected code path trusts a caller identity or capability token that an attacker-controlled local process can influence, rather than independently verifying that the caller is authorized for the requested interface or method.

Attack Vector

Exploitation requires local presence on the Windows system and user interaction with Chrome. A malicious program running under the user's account issues IPC messages that the Mojo layer accepts without proper authorization. The attacker then invokes functionality normally reserved for privileged browser-side components, breaking out of the renderer sandbox and achieving arbitrary code execution in the broker process context.

No verified proof-of-concept code has been published. Technical details are available in the Chrome Desktop Update Announcement and the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-110144

Indicators of Compromise

Chrome processes (chrome.exe) spawning unexpected child processes or writing to directories outside the standard profile path.
Local processes opening handles to Chrome Mojo IPC pipes under \\.\pipe\mojo.* without a legitimate parent-child relationship to Chrome.
Unexpected creation or modification of files in %LOCALAPPDATA%\Google\Chrome\User Data\ by non-Chrome processes.

Detection Strategies

Hunt for Chrome broker-process child executions that do not match known-good telemetry baselines, particularly command shells, scripting hosts, or LOLBins launched from chrome.exe.
Correlate installation or execution of unsigned local binaries with subsequent anomalous Chrome IPC activity.
Inventory Chrome versions across the Windows fleet and flag any instance below 155.0.8059.79 as exposed.

Monitoring Recommendations

Enable Windows process-creation and named-pipe telemetry (Event IDs 4688 and 5145) and forward to the SIEM for correlation.
Monitor endpoint EDR telemetry for sandbox-escape patterns such as renderer-origin writes to sensitive registry hives or token-manipulation APIs.
Track Chrome auto-update health; alert when devices stall on versions prior to 155.0.8059.79.

How to Mitigate CVE-2026-110144

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 155.0.8059.79 or later.
Verify that Chrome's background auto-update service is running and not blocked by group policy or network filtering.
Restrict installation and execution of unapproved local programs through application control policies such as Windows Defender Application Control or AppLocker.

Patch Information

Google addressed CVE-2026-110144 in the stable channel release referenced in the Chrome Desktop Update Announcement. Administrators should confirm deployment of Chrome 155.0.8059.79 or later. Chromium-based browsers on Windows should be updated to builds that incorporate the upstream Mojo authorization fix tracked in the Chromium Issue Tracker Entry.

Workarounds

No vendor-supplied workaround replaces the patch; prioritize upgrading to the fixed Chrome build.
Enforce least privilege on Windows user accounts so that malicious local programs cannot persist or interact with Chrome under elevated contexts.
Where feasible, limit browser usage on multi-tenant Windows hosts until patch deployment is confirmed across the fleet.

bash

# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Force Chrome update check via the Google Update client
& "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler