CVE-2026-110170: Google Chrome Bindings Use-After-Free

CVE-2026-110170 Overview

CVE-2026-110170 is a use-after-free vulnerability [CWE-416] in the Bindings component of Google Chrome. The flaw affects Chrome versions prior to 155.0.8059.79. A remote attacker can read memory inside the Chrome sandbox by serving a crafted HTML page to a victim. Exploitation requires user interaction, such as visiting a malicious website. Google classifies the Chromium security severity as High, while the National Vulnerability Database records a lower CVSS score reflecting the confidentiality-only impact and sandbox containment.

Critical Impact
Successful exploitation allows a remote attacker to read sensitive process memory inside the Chrome renderer sandbox through a crafted web page.

Affected Products

Google Chrome Desktop versions prior to 155.0.8059.79
Chromium-based browsers incorporating the vulnerable Bindings component
Embedded web views built on affected Chromium releases

Discovery Timeline

2026-10-13 - CVE-2026-110170 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110170

Vulnerability Analysis

The vulnerability resides in Chrome's Bindings subsystem, which bridges JavaScript objects with the underlying C++ implementations in the renderer. A use-after-free condition occurs when the browser continues to reference a Bindings object after its backing memory has been released. An attacker can trigger the condition from JavaScript executing within a crafted HTML page.

The resulting read primitive is constrained to memory accessible inside the renderer sandbox. The attacker cannot directly escape the sandbox using this flaw alone. However, information leaked from freed memory can defeat Address Space Layout Randomization (ASLR), reveal pointers, or expose sensitive data processed by the renderer. Attackers commonly chain memory disclosure bugs with separate sandbox escapes to achieve full remote code execution.

Root Cause

The root cause is improper object lifetime management in the Bindings layer, cataloged as CWE-416: Use After Free. A pointer or handle continues to reference a Bindings-managed allocation after that allocation has been freed, allowing subsequent read operations to return stale heap contents.

Attack Vector

Exploitation is network-based and requires the victim to load attacker-controlled HTML in a vulnerable Chrome build. The crafted page uses JavaScript to manipulate object lifetimes within the Bindings layer, free a target object, and then read reclaimed memory. No authentication is required. See the Chromium Issue Tracker #496308073 and the Google Chrome Stable Update for the vendor advisory.

No public proof-of-concept exploit is available for this CVE at the time of publication.

Detection Methods for CVE-2026-110170

Indicators of Compromise

Chrome renderer processes crashing with heap-use-after-free signatures in crash dumps or AddressSanitizer logs
Browser navigation to unfamiliar domains immediately preceding renderer instability
Outbound connections from workstations to recently registered or low-reputation web infrastructure hosting active content

Detection Strategies

Inventory Chrome versions across managed endpoints and flag any installation below 155.0.8059.79
Monitor endpoint telemetry for repeated chrome.exe renderer crashes correlated with specific URLs
Correlate proxy and DNS logs with threat intelligence feeds covering exploit-kit and watering-hole infrastructure

Monitoring Recommendations

Enable browser crash reporting and forward reports to a central telemetry pipeline for triage
Alert when Chrome child processes spawn unexpected children such as command shells or scripting hosts
Track browser version drift continuously rather than through point-in-time compliance scans

How to Mitigate CVE-2026-110170

Immediate Actions Required

Update Google Chrome to version 155.0.8059.79 or later on all desktop platforms
Restart browser sessions after the update to ensure the patched binaries are loaded
Validate that Chromium-based browsers and embedded web views have received equivalent upstream patches

Patch Information

Google addressed CVE-2026-110170 in the Chrome Stable channel release 155.0.8059.79. Deployment details are documented in the Google Chrome Stable Update announcement. Enterprise administrators should push the update through managed deployment tooling and verify version compliance on all endpoints.

Workarounds

Restrict browsing to trusted sites using enterprise web filtering or allow-list policies until patching completes
Enforce Chrome's Site Isolation policy to limit cross-origin data exposure in the renderer
Disable JavaScript on untrusted origins through group policy where operationally feasible

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Enforce automatic updates via policy on Linux
cat >/etc/opt/chrome/policies/managed/update_policy.json <<'EOF'
{
  "UpdateDefault": 1,
  "AutoUpdateCheckPeriodMinutes": 60
}
EOF