CVE-2026-110164: Google Chrome DOM Use After Free Vulnerability

CVE-2026-110164 Overview

CVE-2026-110164 is a use-after-free vulnerability in the Document Object Model (DOM) implementation of Google Chrome. Versions prior to 155.0.8059.79 are affected. A remote attacker can exploit this flaw by serving a crafted HTML page to a target browser. Successful exploitation allows arbitrary code execution inside the Chromium sandbox. The weakness is classified under CWE-416: Use After Free. Chromium assigns this issue a High security severity rating.

Critical Impact
Remote attackers can execute arbitrary code within the renderer sandbox by convincing a user to visit a crafted web page, enabling browser compromise as the first stage of a potential sandbox escape chain.

Affected Products

Google Chrome Desktop versions prior to 155.0.8059.79
Chromium-based browsers incorporating the vulnerable DOM component
Embedded applications using affected Chromium builds

Discovery Timeline

2026-10-13 - CVE-2026-110164 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110164

Vulnerability Analysis

The vulnerability is a use-after-free condition in the DOM subsystem of Blink, Chrome's rendering engine. A use-after-free occurs when code continues to reference a heap object after that object has been freed. An attacker who controls the lifecycle of DOM nodes through JavaScript can trigger the dangling reference and reclaim the freed memory with attacker-controlled data.

Once the stale pointer is dereferenced, the renderer process operates on attacker-shaped memory. This typically enables control-flow hijacking or object type confusion, culminating in arbitrary code execution inside the sandboxed renderer. Exploitation requires user interaction, specifically navigation to a malicious page or loading of malicious third-party content.

Root Cause

The root cause is improper object lifetime management within the DOM. Reference tracking fails to prevent access to a DOM-related heap object after it has been released. Full technical details are maintained in the restricted Chromium Issue Tracker Entry and will be opened publicly after a patch adoption window.

Attack Vector

Exploitation requires a victim to load attacker-controlled HTML and JavaScript in a vulnerable Chrome build. Delivery vectors include phishing links, malicious advertisements, compromised legitimate sites, and iframes embedded in otherwise benign pages. Code execution is initially confined to the renderer sandbox, so chaining with a sandbox-escape primitive would be required for full host compromise.

No verified proof-of-concept code is publicly available. Refer to the Google Chrome Desktop Update for vendor guidance.

Detection Methods for CVE-2026-110164

Indicators of Compromise

Chrome renderer process crashes with memory access violations correlated to recent web navigation.
Unexpected child processes spawned by chrome.exe or the renderer on endpoints running vulnerable builds.
Outbound network connections from renderer processes to unfamiliar domains following page loads.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build earlier than 155.0.8059.79.
Monitor browser telemetry for repeated renderer crashes, which often indicate use-after-free exploitation attempts.
Hunt for process-tree anomalies where a browser renderer spawns scripting hosts, shells, or LOLBins.

Monitoring Recommendations

Ingest endpoint and browser telemetry into a central analytics platform to correlate crashes with URL navigation events.
Alert on execution of child processes under Chrome that fall outside an approved baseline.
Track proxy and DNS logs for suspicious domains serving HTML payloads to users running outdated Chrome versions.

How to Mitigate CVE-2026-110164

Immediate Actions Required

Update Google Chrome to version 155.0.8059.79 or later on all managed endpoints.
Force-restart Chrome after update deployment to ensure the patched binary is loaded.
Audit Chromium-based applications and Electron bundles for the vulnerable DOM component and apply vendor updates.

Patch Information

Google released the fix in the Stable Channel update documented in the Google Chrome Desktop Update advisory. Administrators should enforce the update through enterprise policy and verify that Chrome auto-update is not disabled on managed endpoints.

Workarounds

Restrict browsing to trusted sites using URL filtering or secure web gateway controls until patching completes.
Disable JavaScript on untrusted origins through enterprise Chrome policy where operationally feasible.
Deploy site isolation and strict ad-blocking to reduce exposure to malicious third-party content.

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version