CVE-2026-110915: Google Chrome Use After Free Vulnerability

CVE-2026-110915 Overview

CVE-2026-110915 is a use-after-free vulnerability in the Compositing component of Google Chrome. The flaw affects versions prior to 155.0.8059.84 and allows a remote attacker to execute arbitrary code inside the Chrome sandbox through a crafted HTML page. Exploitation requires user interaction, specifically visiting an attacker-controlled web page. Google tracks the issue under the Chromium security severity rating of Medium, while the National Vulnerability Database assigns it a higher score due to the arbitrary code execution impact. The vulnerability is classified as [CWE-416] Use After Free.

Critical Impact
A remote attacker can execute arbitrary code inside the Chrome renderer sandbox by convincing a user to open a crafted HTML page.

Affected Products

Google Chrome versions prior to 155.0.8059.84
Chromium-based browsers inheriting the vulnerable Compositing code
Desktop builds across Windows, macOS, and Linux Stable channel

Discovery Timeline

2026-10-15 - CVE-2026-110915 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-110915

Vulnerability Analysis

The vulnerability resides in the Compositing subsystem of Blink, which coordinates GPU-accelerated rendering of web content layers. A use-after-free condition occurs when the compositor references a memory object that has already been released. An attacker who controls the lifecycle of compositing objects through crafted HTML, CSS, or JavaScript can trigger premature deallocation while a dangling pointer remains in use. Successful exploitation leads to arbitrary code execution inside the sandboxed renderer process. Sandbox-contained code execution is typically chained with a sandbox escape to achieve full system compromise. See the Chrome Blog Update and the Chromium Issue Tracker Entry for upstream details.

Root Cause

The root cause is improper object lifetime management in the Compositing component. When an object is freed while another code path retains a reference, subsequent access reads or writes memory that may have been reallocated to attacker-controlled data. This condition maps to [CWE-416] Use After Free.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page and lures a victim to visit it through phishing, malvertising, or a compromised site. Once rendered, the page manipulates compositing layers to trigger the dangling pointer and achieve code execution within the renderer sandbox.

No verified public proof-of-concept is available at this time. Refer to the Chromium Issue Tracker Entry for restricted technical details.

Detection Methods for CVE-2026-110915

Indicators of Compromise

Chrome renderer process crashes referencing compositor or GPU layer objects in crash telemetry
Unexpected child process creation from chrome.exe after browsing untrusted sites
Outbound connections from browser processes to unfamiliar domains following HTML page loads

Detection Strategies

Inventory Chrome versions across the fleet and flag any build earlier than 155.0.8059.84
Monitor endpoint telemetry for anomalous process trees spawned by the browser, including shell interpreters or script hosts
Correlate browser crash reports with recently visited URLs to identify potential exploitation attempts

Monitoring Recommendations

Enable Chrome Enterprise reporting to capture version, crash, and extension telemetry centrally
Ingest browser process events into an EDR or SIEM for behavioral analysis
Alert on renderer processes performing file-system writes or network calls outside normal profile paths

How to Mitigate CVE-2026-110915

Immediate Actions Required

Update Google Chrome to version 155.0.8059.84 or later on all desktop platforms
Restart browser sessions after patch deployment to ensure updated binaries are loaded
Audit Chromium-based browsers and embedded WebView components for the fixed version

Patch Information

Google addressed the vulnerability in the Chrome Stable channel update documented in the Chrome Blog Update. Administrators should push the update through Chrome Enterprise policies, managed software distribution systems, or operating system package managers.

Workarounds

Restrict browsing to trusted sites via web proxy or DNS filtering until patching is complete
Deploy Chrome Enterprise policy to disable JavaScript on untrusted origins where feasible
Isolate high-risk browsing through a remote browser isolation (RBI) solution

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# macOS: query bundle version
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString