CVE-2026-110172: Google Chrome Media Use After Free Flaw

CVE-2026-110172 Overview

CVE-2026-110172 is a use-after-free vulnerability in the Media component of Google Chrome. The flaw affects Chrome versions prior to 155.0.8059.79 and allows a remote attacker to execute arbitrary code inside the Chrome sandbox through a crafted HTML page. The Chromium project rates the security severity as High. The vulnerability is classified under CWE-416: Use After Free and requires user interaction, typically by visiting a malicious web page.

Critical Impact
Arbitrary code execution inside the Chrome sandbox from a single visit to an attacker-controlled HTML page.

Affected Products

Google Chrome Desktop versions prior to 155.0.8059.79
Chromium-based browsers that embed the vulnerable Media component
Downstream distributions pending backport of the Chromium fix

Discovery Timeline

2026-10-13 - CVE-2026-110172 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110172

Vulnerability Analysis

The vulnerability resides in Chrome's Media subsystem, which handles decoding, playback, and streaming of audio and video content. A use-after-free condition occurs when the code continues to reference a memory region after it has been released back to the allocator. An attacker who controls the content loaded in a tab can trigger the dangling reference and reclaim the freed memory with attacker-controlled data.

Successful exploitation yields arbitrary code execution inside the renderer process. The Chromium advisory confirms that execution remains constrained by the sandbox, so a second vulnerability would be required to achieve full host compromise. Chained with a sandbox escape, this class of flaw has historically enabled drive-by remote code execution.

Root Cause

Use-after-free defects in Chrome's Media pipeline typically originate from lifetime mismanagement between media objects, their task runners, and callbacks dispatched across threads. The specifics for this issue are tracked in the Chromium Issue Tracker entry, which remains access-restricted pending broader patch adoption.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build. No authentication is needed and the attack is performed over the network. User interaction is limited to opening a link or visiting a site that renders attacker-controlled media markup, which can also be delivered through advertisements or embedded iframes on otherwise legitimate sites. Details are described in prose only; no verified public proof-of-concept is available at the time of writing. See the Chrome Releases blog for the vendor advisory.

Detection Methods for CVE-2026-110172

Indicators of Compromise

Chrome renderer process crashes with signatures referencing media decoder or pipeline modules
Unexpected child processes spawned from chrome.exe immediately after visiting an untrusted page
Outbound connections to newly registered domains serving HTML pages with unusual <video>, <audio>, or Media Source Extensions payloads

Detection Strategies

Inventory browser versions across the fleet and alert on Chrome builds below 155.0.8059.79
Correlate renderer crash telemetry with recent web navigation events to identify exploitation attempts
Apply web content filtering to block known malicious domains distributing weaponized HTML

Monitoring Recommendations

Collect Chrome crash reports and endpoint process-creation telemetry into a centralized data lake for correlation
Monitor for anomalous script execution or file writes performed by child processes of the browser
Track egress traffic from endpoints following browser crashes to catch post-exploitation callbacks

How to Mitigate CVE-2026-110172

Immediate Actions Required

Update Google Chrome to version 155.0.8059.79 or later on all desktop platforms
Restart browser processes after the update to ensure the patched binary is loaded
Push the update through enterprise management tooling and verify compliance across endpoints

Patch Information

Google fixed this issue in the Chrome Stable channel release documented in the Chrome Releases Stable Channel Update for Desktop. Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should be updated once their respective vendors ship builds that incorporate the upstream Chromium fix.

Workarounds

Restrict browsing to trusted sites using URL filtering or secure web gateways until patches are deployed
Disable autoplay and limit media-rich content on untrusted origins through enterprise browser policies
Enable Chrome's Site Isolation and ensure the sandbox is not weakened by administrative overrides

bash

# Verify installed Chrome version on Windows via Group Policy reporting
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version