CVE-2026-110913 Overview
CVE-2026-110913 is a memory corruption vulnerability in the Document Object Model (DOM) implementation of Google Chrome. The flaw affects Chrome versions prior to 155.0.8059.84 and permits a remote attacker to execute arbitrary code within the browser sandbox. Exploitation requires a victim to load a crafted HTML page, satisfying the user interaction requirement in the CVSS vector. Google classifies the Chromium security severity as High. The weakness is cataloged under CWE-119, covering improper restriction of operations within the bounds of a memory buffer.
Critical Impact
A remote attacker can achieve arbitrary code execution inside the Chrome sandbox by convincing a user to visit a malicious web page.
Affected Products
- Google Chrome versions prior to 155.0.8059.84 (Desktop Stable channel)
- Chromium-based builds sharing the vulnerable DOM code path
- All operating systems supported by the Chrome Stable channel
Discovery Timeline
- 2026-10-15 - CVE-2026-110913 published to the National Vulnerability Database
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-110913
Vulnerability Analysis
The vulnerability resides in Chrome's DOM subsystem, which parses, constructs, and manipulates HTML document trees. Memory corruption occurs when the renderer processes attacker-controlled HTML content. An attacker can leverage the corrupted memory state to redirect execution flow and run arbitrary code inside the renderer process. Because the renderer executes inside Chrome's sandbox, successful exploitation yields code execution confined to that sandbox boundary. Combined with a separate sandbox escape, the flaw could extend to the host operating system.
The vulnerability has a low EPSS probability at the time of publication, indicating limited observed exploitation activity in the wild. However, DOM memory corruption bugs historically attract exploit development due to their broad reach across Chromium-derived browsers.
Root Cause
The underlying weakness maps to CWE-119, improper restriction of operations within the bounds of a memory buffer. Google has not publicly disclosed the specific object lifecycle or allocator interaction responsible for the corruption. Technical specifics remain restricted via the Chromium Issue Tracker #567638392 to protect users while patches propagate.
Attack Vector
Exploitation is network-based and requires user interaction. The attacker hosts a crafted HTML page and lures the victim to visit it through phishing, malvertising, or a compromised site. Once the page loads, the renderer parses attacker-controlled DOM content and triggers the memory corruption. No authentication is required, and the attack complexity is low.
No verified proof-of-concept code is publicly available. Readers requiring technical specifics should consult the Google Chrome Stable Update advisory.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-110913
Indicators of Compromise
- Unexpected Chrome renderer process crashes correlated with visits to untrusted sites
- Child processes spawned by chrome.exe that deviate from the normal browser process tree
- Outbound connections from renderer processes to unfamiliar domains following page loads
Detection Strategies
- Inventory browser versions across the fleet and flag any Chrome installation below 155.0.8059.84
- Monitor endpoint telemetry for renderer process anomalies, including crashes, heap integrity violations, and shellcode-like memory regions
- Correlate web proxy logs with endpoint events to identify users who visited suspicious domains immediately before a Chrome crash
Monitoring Recommendations
- Ingest Chrome crash telemetry and browser version data into the SIEM for continuous version-drift reporting
- Alert on unsigned or unexpected modules loaded into Chrome renderer processes
- Track access to known malvertising and exploit kit infrastructure through DNS and proxy logs
How to Mitigate CVE-2026-110913
Immediate Actions Required
- Update Google Chrome to version 155.0.8059.84 or later on all managed endpoints
- Restart Chrome after the update to ensure the patched binary is loaded
- Audit Chromium-based browsers and embedded WebView components for equivalent patches from their vendors
Patch Information
Google addressed the vulnerability in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. Enterprise administrators should push the update through managed deployment tooling and verify version compliance via group policy or MDM reporting.
Workarounds
- Enforce strict web filtering to block access to untrusted or newly registered domains until patching completes
- Disable JavaScript or restrict site permissions for high-risk user groups through enterprise policy as a temporary measure
- Use browser isolation or remote browser services for users who must access untrusted content before the patch is deployed
# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\WOW6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Verify installed Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
