CVE-2026-110156: Google Chrome Mac Extension RCE Vulnerability

CVE-2026-110156 Overview

CVE-2026-110156 is an incorrect reference resolution vulnerability in the Extensions component of Google Chrome on macOS prior to version 155.0.8059.79. A remote attacker who has already compromised the renderer process can execute arbitrary code outside the Chrome sandbox by delivering a crafted Chrome extension. The weakness is classified under CWE-706: Use of Incorrectly-Resolved Name or Reference and is tracked by the Chromium project as a High-severity issue.

Critical Impact
Successful exploitation chains with a renderer compromise to achieve sandbox escape and arbitrary code execution on macOS endpoints, breaking the browser's primary isolation boundary.

Affected Products

Google Chrome on macOS prior to 155.0.8059.79
Chromium-based macOS browsers that incorporate the vulnerable Extensions reference resolution logic
Managed Chrome deployments on macOS fleets not yet updated to the Stable channel fix

Discovery Timeline

2026-10-13 - CVE-2026-110156 published to the National Vulnerability Database (NVD)
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110156

Vulnerability Analysis

The vulnerability resides in how the Chrome Extensions subsystem resolves references on macOS builds prior to 155.0.8059.79. When the browser resolves an identifier associated with an extension object, it can bind to an unintended target, allowing an attacker who controls the renderer to redirect execution flow across the sandbox boundary.

Exploitation requires an attacker to first compromise the renderer process, typically through a separate memory-safety bug or logic flaw. The attacker then loads or interacts with a crafted Chrome extension that triggers the incorrect reference resolution in a higher-privileged browser process. This produces a sandbox escape, giving the attacker code execution with the privileges of the Chrome browser process on macOS.

User interaction is required to realize the full impact, consistent with scenarios involving extension installation, navigation to attacker-controlled content, or interaction with crafted extension UI. The scope change reflects that the compromise crosses the renderer sandbox trust boundary into the broader browser context.

Root Cause

The root cause is improper resolution of a name or reference inside the Extensions code path [CWE-706]. The Extensions subsystem resolves an identifier to a resource or object without sufficient validation of the resolution context. An attacker-controlled renderer can influence the lookup so that privileged logic operates on an attacker-chosen target rather than the intended one, defeating the sandbox's structural assumption that renderer-supplied references cannot reach privileged browser objects directly.

Attack Vector

The attack chain is network-reachable and begins with renderer compromise, typically via a malicious web page. The attacker then delivers a crafted extension payload or triggers extension-handling logic that exercises the flawed reference resolution. Because exploitation requires both a pre-existing renderer compromise and user interaction, the attack complexity is high, but the resulting sandbox escape yields arbitrary code execution outside Chrome's renderer isolation on macOS. Technical specifics are tracked in Chromium Issue #561892119 and the Google Chrome Stable Update advisory.

Detection Methods for CVE-2026-110156

Indicators of Compromise

Chrome processes on macOS spawning unexpected child processes or writing to directories outside the standard Chrome application support paths.
Installation or sideloading of Chrome extensions from sources other than the Chrome Web Store, especially unpacked or developer-mode extensions.
Outbound network connections from the Chrome browser process to previously unseen command-and-control infrastructure immediately after extension interaction.

Detection Strategies

Inventory installed Chrome extensions across managed macOS endpoints and alert on extensions missing a Chrome Web Store identifier or published by untrusted developers.
Monitor for Chrome versions on macOS reporting a build string below 155.0.8059.79 through endpoint telemetry or software inventory.
Alert on behavioral deviations such as the Chrome browser process executing shell binaries, modifying LaunchAgents, or accessing Keychain data outside normal patterns.

Monitoring Recommendations

Ingest Chrome enterprise reporting and macOS endpoint process telemetry into a central analytics pipeline to correlate extension events with post-exploitation behavior.
Track extension installation and update events using the Chrome ExtensionInstallForcelist and ExtensionInstallBlocklist policy audit logs.
Build hunting queries that pivot from Chrome renderer or browser process anomalies to subsequent file system, persistence, and network activity on macOS hosts.

How to Mitigate CVE-2026-110156

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 155.0.8059.79 or later through managed software distribution.
Audit installed Chrome extensions and remove any unapproved, sideloaded, or developer-mode extensions from managed devices.
Restrict extension installation to an allowlist of vetted Chrome Web Store IDs using enterprise policy.

Patch Information

Google addressed the issue in the Stable channel update for desktop announced at the Google Chrome Stable Update advisory. The fix ships in Chrome 155.0.8059.79 for macOS. Technical tracking is maintained in Chromium Issue #561892119. Administrators should force Chrome to update and verify the installed version on every managed macOS endpoint.

Workarounds

Enforce Chrome enterprise policies that disable developer mode and block installation of extensions outside an approved allowlist until all endpoints are patched.
Reduce exposure by routing Chrome traffic through filtering infrastructure that blocks known malicious domains serving renderer-exploitation payloads.
Where feasible, require users to run Chrome under standard (non-administrative) macOS accounts to limit the impact of a sandbox escape.