CVE-2026-110167: Google Chrome Media Use-After-Free Flaw

CVE-2026-110167 Overview

CVE-2026-110167 is a use-after-free vulnerability [CWE-416] in the Media component of Google Chrome prior to version 155.0.8059.79. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. Google rates the Chromium security severity as High.

The flaw requires user interaction and no privileges, making drive-by exploitation through malicious or compromised web content feasible. Code execution is confined to the renderer sandbox but can be chained with sandbox escape bugs to achieve full compromise.

Critical Impact
Remote attackers can execute arbitrary code in the Chrome renderer process by serving a crafted HTML page, enabling browser compromise and a foothold for further sandbox escape chains.

Affected Products

Google Chrome Desktop versions prior to 155.0.8059.79
Chromium-based browsers incorporating the vulnerable Media component
All supported desktop platforms (Windows, macOS, Linux)

Discovery Timeline

2026-10-13 - CVE-2026-110167 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110167

Vulnerability Analysis

The vulnerability resides in the Media subsystem of Chrome, which handles decoding, playback, and streaming of audio and video content. A use-after-free condition [CWE-416] occurs when the Media component retains a pointer to an object that has already been freed. When the dangling pointer is later dereferenced, attacker-controlled data can occupy the freed memory region.

Successful exploitation yields arbitrary code execution within the Chrome renderer process. The attack requires network access, low complexity, and user interaction such as visiting a malicious page. Confidentiality, integrity, and availability are all impacted at the renderer level.

Technical details are tracked in Chromium Issue Tracker #570461696, which remains restricted pending broader patch adoption.

Root Cause

Use-after-free bugs in media pipelines typically result from improper lifetime management of objects shared between the demuxer, decoder, and renderer threads. An object is released on one code path while another path continues to hold and later dereference the pointer. The Media component's asynchronous processing increases the likelihood of such lifetime mismatches.

Attack Vector

An attacker hosts a crafted HTML page containing malicious media content, such as a specially constructed video or audio element. When a victim visits the page, Chrome parses and processes the media through the vulnerable code path. The attacker triggers the free-then-use sequence, grooms the heap, and redirects execution flow to achieve code execution in the sandboxed renderer.

No authentication is required. The attack can be delivered through phishing links, malvertising, compromised websites, or embedded iframes on third-party sites.

No verified public exploitation code is available at this time. See the Google Chrome Desktop Update for release details.

Detection Methods for CVE-2026-110167

Indicators of Compromise

Chrome renderer process crashes referencing media playback modules in crash dumps or Windows Event Viewer
Unexpected child processes spawned by chrome.exe after visiting untrusted media-heavy pages
Outbound network connections from renderer processes to unfamiliar hosts following media playback
Browser telemetry showing visits to pages with obfuscated <video> or <audio> payloads

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build older than 155.0.8059.79
Monitor endpoint telemetry for anomalous process behavior originating from Chrome renderer processes
Correlate web proxy logs with endpoint events to identify users served crafted media content
Hunt for unsigned or injected modules loaded into Chrome processes

Monitoring Recommendations

Enable crash reporting and ingest Chrome crash telemetry into the SIEM for triage
Track browser version compliance through enterprise management tools such as Chrome Browser Cloud Management
Alert on new or unexpected process creation chains where Chrome is the parent process

How to Mitigate CVE-2026-110167

Immediate Actions Required

Update Google Chrome to version 155.0.8059.79 or later on all desktop endpoints
Restart Chrome after update deployment to ensure the patched binary is loaded
Verify auto-update is enabled and functioning across managed browser installations
Prioritize patching for users with broad internet access or elevated local privileges

Patch Information

Google released the fix in the Chrome Stable channel at version 155.0.8059.79. Refer to the Google Chrome Desktop Update advisory for full release notes. Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should be updated once their vendors ship the backported fix.

Workarounds

Restrict access to untrusted sites through web filtering or DNS-based controls until patching completes
Deploy site isolation and strict sandbox policies via Chrome enterprise policies
Disable autoplay of media on untrusted origins to reduce opportunistic exposure
Educate users to avoid clicking links from unknown senders during the patch window

bash

# Verify Chrome version on Windows
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify Chrome version on macOS/Linux
google-chrome --version

# Enforce minimum version via enterprise policy (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "155.0.8059.79" /f