CVE-2026-110160 Overview
CVE-2026-110160 is a missing authorization vulnerability [CWE-862] in the ReadingMode component of Google Chrome prior to version 155.0.8059.79. A remote attacker who has already compromised the renderer process can leverage social engineering to potentially bypass site isolation through a crafted HTML page. Google classified this as a Chromium security severity of High, while the NVD assigned a medium rating based on preconditions including user interaction and a prior renderer compromise. Site isolation is a core Chrome security boundary that separates web content from different sites into distinct processes, and bypassing it undermines protections against cross-origin data access.
Critical Impact
An attacker with a compromised renderer process can bypass Chrome's site isolation boundary via ReadingMode, potentially enabling cross-origin information disclosure when a user is lured into interacting with a crafted page.
Affected Products
- Google Chrome for Desktop prior to 155.0.8059.79
- Chromium-based browsers incorporating affected ReadingMode code
- Downstream distributions bundling vulnerable Chromium builds
Discovery Timeline
- 2026-10-13 - CVE-2026-110160 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-110160
Vulnerability Analysis
The flaw resides in Chrome's ReadingMode feature, which reformats web page content into a simplified reading view. ReadingMode fails to enforce proper authorization checks before performing operations that cross security boundaries. Chrome's site isolation architecture places documents from different sites into separate renderer processes to prevent one origin from reading another. When ReadingMode processes content without validating authorization, an attacker can abuse the feature to reach data that should remain isolated.
The vulnerability requires two preconditions. First, the attacker must already control a renderer process, typically via a prior exploit chain. Second, the victim must be socially engineered into performing an action that triggers the ReadingMode code path on attacker-crafted content.
Root Cause
The root cause is a missing authorization check [CWE-862] in the ReadingMode component. Code paths that should validate the origin or process boundary of a request proceed without verifying that the caller has permission to access the targeted content. This design gap allows a compromised renderer to request operations that site isolation would otherwise block.
Attack Vector
Exploitation is network-based but requires a chained precondition. The attacker first compromises a renderer process, which commonly involves exploiting a separate memory corruption or logic flaw in Chrome. The attacker then hosts a crafted HTML page and relies on social engineering to persuade the user to interact with ReadingMode on that page. Once triggered, the missing authorization check lets the attacker bypass site isolation and access data from another origin loaded in the browser.
No public proof-of-concept exploit is listed in the available references. Technical details are tracked in Chromium Issue #552510359 and the Chrome Stable Channel Update.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-110160
Indicators of Compromise
- Chrome browser installations reporting a version string below 155.0.8059.79
- Unexpected renderer process crashes or anomalous child process spawning preceding ReadingMode activation
- Outbound connections from browser processes to untrusted hosts delivering reader-view styled HTML
Detection Strategies
- Inventory endpoints to identify Chrome and Chromium-based browsers running versions prior to 155.0.8059.79
- Monitor process telemetry for Chrome renderer anomalies that may indicate prior renderer compromise required as a precondition
- Correlate browser logs with web proxy telemetry to flag user interaction with attacker-controlled pages invoking reader features
Monitoring Recommendations
- Enable centralized collection of Chrome version data via management policies or endpoint inventory tools
- Alert on Chrome processes making unusual cross-origin network requests shortly after ReadingMode usage
- Track Chrome update compliance across managed fleets and escalate hosts that fail to reach the patched build
How to Mitigate CVE-2026-110160
Immediate Actions Required
- Update Google Chrome Desktop to version 155.0.8059.79 or later across all managed endpoints
- Verify that Chromium-derived browsers in the environment have incorporated the upstream fix
- Reinforce user awareness training on social engineering lures that drive interaction with untrusted pages
Patch Information
Google addressed CVE-2026-110160 in Chrome Stable channel version 155.0.8059.79. Details are published in the Chrome Stable Channel Update for Desktop. Administrators managing enterprise fleets should push the update through Google Update, Chrome Browser Cloud Management, or their standard software distribution tooling.
Workarounds
- Disable or restrict the ReadingMode feature via enterprise policy where business workflows permit
- Enforce strict site isolation and block execution of untrusted browser extensions that may facilitate renderer compromise
- Restrict user navigation to untrusted sites using web filtering until the patch is deployed
# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version
# Windows: query installed Chrome version via registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
