CVE-2026-110166: Google Chrome Buffer Overflow Vulnerability

CVE-2026-110166 Overview

CVE-2026-110166 is a heap buffer overflow [CWE-122] in the Animation component of Google Chrome. The flaw affects Chrome versions prior to 155.0.8059.79. A remote attacker can execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to a victim. Google's Chromium team rated the issue High severity. Exploitation requires user interaction, specifically visiting an attacker-controlled page.

Critical Impact
Successful exploitation permits arbitrary code execution inside the Chrome renderer sandbox, giving attackers a foothold for further sandbox-escape chains and data theft.

Affected Products

Google Chrome Desktop versions prior to 155.0.8059.79
Chromium-based browsers that embed the vulnerable Animation code paths
Downstream distributions pending uplift of the 155.0.8059.79 fix

Discovery Timeline

2026-10-13 - CVE-2026-110166 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110166

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in Chrome's Animation subsystem, which manages CSS animations, Web Animations API objects, and compositor-driven effects. When processing a crafted sequence of animation operations, the component writes past the bounds of a heap-allocated buffer. The resulting corruption of adjacent heap metadata or object pointers enables arbitrary code execution within the renderer process.

Because renderer processes handle untrusted web content, exploitation is confined to the sandbox. Attackers typically pair such bugs with a separate sandbox-escape vulnerability to achieve code execution on the host. The flaw is reachable from standard web APIs with no special privileges on the target system.

Root Cause

The root cause is improper bounds enforcement when the Animation code allocates or writes to a heap buffer sized from attacker-influenced inputs. Chromium issue #566496747 tracks the defect. Google has not released detailed root-cause analysis while patch adoption completes.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build. The attacker hosts malicious JavaScript and CSS that trigger the overflow through animation primitives. No authentication is required, and user interaction is limited to visiting the page. Phishing links, malvertising, and compromised legitimate sites are plausible delivery vectors.

Technical details are available in the Google Chrome Stable Update announcement and the referenced Chromium issue.

Detection Methods for CVE-2026-110166

Indicators of Compromise

Chrome renderer process crashes with heap corruption signatures referencing animation or compositor modules
Unexpected child processes spawned by chrome.exe shortly after browsing activity
Outbound connections from renderer processes to newly registered or low-reputation domains hosting HTML and JavaScript payloads

Detection Strategies

Inventory Chrome versions across managed endpoints and flag any build earlier than 155.0.8059.79
Hunt for anomalous renderer-to-system process transitions, which may indicate chained sandbox escapes following initial exploitation
Correlate browser crash telemetry with URL history to identify suspicious pages that triggered animation-related faults

Monitoring Recommendations

Forward Chrome crash dumps and WER telemetry to the SIEM for retrospective hunting against animation module stack frames
Monitor web proxy logs for traffic to domains serving large, obfuscated JavaScript payloads referencing Element.animate or Web Animations APIs
Track endpoint EDR telemetry for process-injection or memory-execution events originating from browser processes

How to Mitigate CVE-2026-110166

Immediate Actions Required

Update Google Chrome to version 155.0.8059.79 or later on all platforms
Restart Chrome after updating to ensure patched binaries are loaded by all tabs and extensions
Push the update through enterprise management channels such as Group Policy or MDM to accelerate rollout

Patch Information

Google released the fix in the Chrome Stable channel at version 155.0.8059.79. Enterprises should validate deployment through the Google Chrome Stable Update advisory and the Chromium Issue Tracker entry. Chromium-based browsers including Edge, Brave, Opera, and Vivaldi should be updated once vendors publish aligned builds.

Workarounds

Restrict browsing to trusted sites via web filtering until the patched Chrome build is deployed
Enforce Site Isolation and ensure the sandbox is enabled, since the vulnerability is contained to the renderer
Disable or constrain third-party advertising networks that frequently serve dynamic HTML and JavaScript payloads

bash

# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version