CVE-2026-110914: Google Chrome Workers RCE Vulnerability

CVE-2026-110914 Overview

CVE-2026-110914 is a memory corruption vulnerability in the Workers component of Google Chrome. Versions prior to 155.0.8059.84 are affected. A remote attacker can leverage a crafted HTML page to trigger memory corruption and potentially execute arbitrary code inside the Chrome sandbox. The flaw is tracked under CWE-119, covering improper restriction of operations within the bounds of a memory buffer. Google rated the Chromium security severity as Medium, while the National Vulnerability Database (NVD) assigns a higher score reflecting network reachability and user interaction via web content.

Critical Impact

Remote attackers can achieve arbitrary code execution inside the Chrome renderer sandbox by convincing a user to visit a malicious web page.

Affected Products

• Google Chrome versions prior to 155.0.8059.84 (Desktop Stable channel)
• Chromium-based browsers that embed the vulnerable Workers implementation
• Applications bundling the affected Chromium release for web content rendering

Discovery Timeline

• 2026-10-15 - CVE-2026-110914 published to NVD
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-110914

Vulnerability Analysis

The vulnerability resides in the Workers subsystem of Google Chrome, which manages background script execution contexts such as Web Workers, Service Workers, and Shared Workers. Memory corruption in this component indicates improper handling of buffer bounds during Worker lifecycle or message passing operations. Successful exploitation grants code execution inside the renderer process, which operates within the Chrome sandbox. Attackers typically chain such renderer flaws with a separate sandbox escape to achieve full system compromise. The attack requires only user interaction with a crafted HTML page delivered through any browsing context.

Root Cause

The root cause is a memory safety violation classified under [CWE-119] (improper restriction of operations within the bounds of a memory buffer). Specific technical details of the memory corruption primitive are restricted in the Chromium Issue #563194341 tracker until a majority of users have updated. Chromium issues of this class historically involve use-after-free, out-of-bounds reads or writes, or type confusion within Blink and V8 Worker bindings.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts or injects a crafted HTML page that instantiates a malicious Worker. When the victim loads the page, the Worker triggers the memory corruption condition in the renderer process. The attacker then executes arbitrary code inside the renderer sandbox. Delivery mechanisms include phishing links, malicious advertisements, compromised websites, and cross-site scripting on trusted domains. No authentication or elevated privileges are required.

Verified exploit code is not publicly available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS score is 0.303%. See the Chromium Issue #563194341 for restricted technical details.

Detection Methods for CVE-2026-110914

Indicators of Compromise

• Chrome renderer process crashes in chrome.exe or chrome child processes correlated with Worker activity
• Unexpected child processes spawned by the Chrome renderer following visits to untrusted web pages
• Outbound network connections from browser processes to unfamiliar command-and-control infrastructure
• Suspicious Service Worker registrations persisting across browser sessions on managed endpoints

Detection Strategies

• Inventory browser versions across the fleet and flag Chrome installations below 155.0.8059.84
• Monitor endpoint telemetry for anomalous process trees originating from Chrome renderer processes
• Correlate browser crash reports with recently visited URLs to identify exploitation attempts
• Apply web proxy and DNS filtering to block known malicious domains delivering crafted HTML payloads

Monitoring Recommendations

• Enable crash reporting and centralize Chrome crash dumps for review by the security operations team
• Track Service Worker and Web Worker registrations through browser management policies and extensions
• Alert on execution of unsigned binaries or scripts spawned as descendants of the browser process
• Review threat intelligence feeds for exploit kits or phishing campaigns targeting the Chrome Workers component

How to Mitigate CVE-2026-110914

Immediate Actions Required

• Update Google Chrome to version 155.0.8059.84 or later on all Windows, macOS, and Linux endpoints
• Restart Chrome after the update to ensure the patched binaries are loaded into memory
• Audit Chromium-based browsers and Electron applications for embedded versions below the patched release
• Communicate the update requirement to end users and enforce compliance through managed browser policies

Patch Information

Google released the fix in the Chrome Stable channel update documented at Google Chrome Stable Update. Administrators should deploy version 155.0.8059.84 or later through enterprise update mechanisms such as Google Update, Microsoft Intune, Jamf, or Group Policy. Chromium-based browser vendors including Microsoft Edge, Brave, and Opera typically ship corresponding patches within days of the upstream release.

Workarounds

• Restrict access to untrusted websites through enterprise web filtering until patches are deployed
• Disable Service Workers and Web Workers via enterprise policy where business workflows permit
• Deploy site isolation and strict Content Security Policy headers on internal web applications
• Educate users to avoid clicking unsolicited links and to report unexpected browser crashes

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Enforce auto-update via Group Policy on Windows (registry key)
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f