CVE-2026-110159: Google Chrome Updater RCE Vulnerability

CVE-2026-110159 Overview

CVE-2026-110159 is an incorrect authorization vulnerability [CWE-863] in the Updater component of Google Chrome. The flaw affects Chrome versions prior to 155.0.8059.79 and permits a local attacker to execute arbitrary code outside the browser sandbox by leveraging a local program. Google classifies the Chromium security severity as High. The Updater runs with elevated privileges to manage browser installation and patching, making authorization failures in this component a direct path to sandbox escape and host compromise.

Critical Impact
A local attacker can bypass Chrome's sandbox boundary and execute arbitrary code on the host by abusing authorization checks in the Chrome Updater service.

Affected Products

Google Chrome for Desktop prior to 155.0.8059.79
Chrome Updater component on all supported desktop platforms
Downstream Chromium-based browsers that embed the vulnerable Updater code

Discovery Timeline

2026-10-13 - CVE-2026-110159 published to the National Vulnerability Database
2026-10-14 - Entry last modified in NVD

Technical Details for CVE-2026-110159

Vulnerability Analysis

The Chrome Updater is a privileged background service responsible for installing and applying browser updates. It accepts update and control requests through local inter-process communication channels. The vulnerable code path performs insufficient authorization checks on the identity or integrity of the calling local program before honoring privileged operations. As a result, an unprivileged process running on the same host can direct the Updater to perform actions that cross the sandbox boundary, culminating in arbitrary code execution outside Chrome's renderer sandbox.

The weakness is categorized under CWE-863: Incorrect Authorization. Exploitation requires the attacker to already have the ability to run a local program on the target system, which is consistent with a sandbox-escape primitive chained after a renderer compromise or delivered via a malicious installer.

Root Cause

The Updater fails to correctly validate whether the requesting local program is authorized to invoke privileged operations. Rather than enforcing a complete authorization decision based on caller identity, integrity level, and intended action, the component accepts requests that should be rejected. This permits a lower-privileged caller to trigger code paths intended for trusted components only.

Attack Vector

Exploitation requires local access and some form of user interaction, consistent with the scenario of a sandboxed renderer or user-launched program invoking the Updater interface. Once the authorization check is bypassed, the attacker leverages the Updater's elevated context to run code outside the sandbox. This can be chained with a browser-based initial access vector to achieve full host compromise.

No public proof-of-concept has been published. Technical details are tracked in the restricted Chromium Issue Tracker #564573066 and the Google Chrome Stable Update advisory.

Detection Methods for CVE-2026-110159

Indicators of Compromise

Unexpected child processes spawned by the Chrome Updater service (GoogleUpdater, updater.exe, or platform equivalents) outside of scheduled update windows.
Local IPC connections to the Updater endpoint originating from non-Chrome processes or from renderer processes with reduced integrity.
New or modified files appearing in the Updater installation directory without a corresponding signed update manifest.

Detection Strategies

Hunt for process-lineage anomalies where the Updater launches shells, scripting hosts, or binaries from user-writable paths.
Alert on Chrome renderer or sandboxed worker processes issuing local IPC calls to the Updater interface.
Compare installed Chrome versions across the fleet against the fixed build 155.0.8059.79 and flag older versions as exposed.

Monitoring Recommendations

Collect endpoint telemetry for process creation, module loads, and local IPC on hosts running Chrome and route it to a centralized analytics pipeline.
Monitor file integrity on the Chrome Updater install path and service binaries for unauthorized changes.
Track Chrome version inventory continuously to confirm patch rollout and identify stragglers.

How to Mitigate CVE-2026-110159

Immediate Actions Required

Update Google Chrome to version 155.0.8059.79 or later on all desktop endpoints.
Restart Chrome after the update to ensure the patched Updater binaries are loaded.
Audit the fleet for Chromium-derived browsers and apply vendor patches that incorporate the upstream fix.

Patch Information

Google addressed CVE-2026-110159 in the Chrome Stable channel at version 155.0.8059.79. Deployment details are documented in the Google Chrome Stable Update release notes. Enterprises using managed deployment should force an update cycle rather than waiting for the default background update interval.

Workarounds

Restrict local execution on sensitive hosts using application control to limit which programs can invoke the Updater interface.
Enforce least privilege for interactive users to reduce the pool of local programs an attacker can leverage.
Where immediate patching is not possible, consider temporarily disabling third-party browser extensions and untrusted local tooling that could be weaponized as the required local program.

bash

# Verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\WOW6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux
google-chrome --version