CVE-2026-110163: Google Chrome DOM Use After Free Vulnerability

CVE-2026-110163 Overview

CVE-2026-110163 is a use-after-free vulnerability in the Document Object Model (DOM) implementation of Google Chrome. The flaw affects Chrome versions prior to 155.0.8059.79 on desktop platforms. A remote attacker can exploit the vulnerability by serving a crafted HTML page to a victim, enabling arbitrary code execution inside the Chrome renderer sandbox. The Chromium project rated the issue as High severity.

The vulnerability maps to CWE-416: Use After Free and requires user interaction, specifically that a target navigates to attacker-controlled content.

Critical Impact
Successful exploitation yields arbitrary code execution within the renderer sandbox, providing a foothold that attackers can chain with a sandbox escape to achieve full compromise of the host.

Affected Products

Google Chrome for Desktop versions prior to 155.0.8059.79
Chromium-based browsers that inherit the vulnerable DOM code path
Embedded frameworks shipping affected Chromium builds (for example, applications using older CEF or Electron releases)

Discovery Timeline

2026-10-13 - CVE-2026-110163 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110163

Vulnerability Analysis

The vulnerability is a use-after-free condition inside Chrome's DOM subsystem. In this class of bug, the renderer frees a C++ object representing a DOM node or associated resource while another code path still holds a reference to it. When the dangling reference is later dereferenced, the renderer operates on reclaimed memory that an attacker can groom with controlled data.

An attacker who shapes the freed slot can hijack virtual function dispatch or corrupt object metadata inside the Blink rendering engine. This grants code execution in the renderer process. The renderer remains confined by Chrome's sandbox, so impact is limited to the sandbox boundary unless chained with a separate escape primitive.

Additional technical context is available in the Chromium Issue Tracker entry and the Google Chrome Desktop Update advisory.

Root Cause

The root cause is incorrect object lifetime management within DOM handling code. A reference to a DOM-related object outlives the object's destruction, producing a dangling pointer. Garbage-collected and reference-counted objects in Blink are both susceptible when script-driven mutations trigger reentrancy during tree manipulation or event dispatch.

Attack Vector

Exploitation requires a user to load a crafted HTML page in a vulnerable Chrome build. Delivery vectors include malicious websites, compromised ad networks, phishing links, and malvertising on legitimate sites. No authentication is required, and the attack can succeed over the network against any user who browses the attacker-controlled content.

No verified public proof-of-concept code is available for CVE-2026-110163 at the time of publication. Refer to the Chromium issue tracker for upstream details once access restrictions are lifted.

Detection Methods for CVE-2026-110163

Indicators of Compromise

Chrome renderer process crashes with signatures referencing DOM, Blink, or heap-use-after-free before patch deployment
Unexpected child processes spawned by chrome.exe following navigation to untrusted content
Outbound connections from renderer processes to previously unseen domains hosting large obfuscated JavaScript payloads

Detection Strategies

Inventory Chrome installations across endpoints and flag any build older than 155.0.8059.79
Correlate browser crash telemetry with URL history to identify pages that trigger reproducible renderer faults
Monitor EDR process trees for anomalous spawn chains originating from Chrome renderer processes

Monitoring Recommendations

Ingest browser version telemetry into the SIEM and alert when hosts drift behind the current Chrome stable channel
Watch for execution of LOLBins or script interpreters launched as children of Chrome following web navigation
Track DNS and proxy logs for connections to domains flagged by threat intelligence as hosting browser exploit kits

How to Mitigate CVE-2026-110163

Immediate Actions Required

Update Google Chrome to version 155.0.8059.79 or later on all Windows, macOS, and Linux endpoints
Restart browser sessions after patching to ensure the vulnerable renderer code is unloaded
Audit Chromium-based applications (Edge, Brave, Electron apps) and apply vendor updates that incorporate the fixed Chromium baseline

Patch Information

Google released the fix in Chrome stable channel 155.0.8059.79. Deployment details are documented in the Google Chrome Desktop Update advisory. Managed environments should push the update through enterprise policy or the Chrome Enterprise MSI, and verify version compliance after rollout.

Workarounds

Enforce site isolation and strict sandbox policies through Chrome Enterprise policies to raise exploitation cost
Restrict browsing to vetted sites via proxy categorization until patches are deployed on all managed endpoints
Deploy script and ad blocking at the network edge to reduce exposure to malvertising delivery of crafted HTML

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# macOS: read the application bundle version
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString