CVE-2026-110918: Google Chrome Information Disclosure Flaw

CVE-2026-110918 Overview

CVE-2026-110918 is a memory corruption vulnerability in the Core component of Google Chrome. The flaw affects Chrome versions prior to 155.0.8059.84 and allows a remote attacker to read process memory by serving a crafted HTML page to a target user. Google's Chromium project rates the underlying security severity as High, while the National Vulnerability Database (NVD) assigns a medium-severity CVSS score reflecting the information disclosure impact and the required user interaction.

The issue is tracked in the Chromium bug tracker as issue #568937999 and is categorized under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer.

Critical Impact
A remote attacker who convinces a user to visit a crafted web page can read sensitive data from Chrome's process memory, potentially exposing credentials, session tokens, or other information rendered in-process.

Affected Products

Google Chrome versions prior to 155.0.8059.84 on Desktop (Stable channel)
Chromium-based Core component (memory handling path)
Downstream Chromium-based browsers inheriting the vulnerable Core code are likely impacted until rebased

Discovery Timeline

2026-10-15 - CVE-2026-110918 published to the National Vulnerability Database
2026-10-19 - Last updated in NVD database
2026-10-22 - EPSS score published at 0.201% (percentile 9.515)

Technical Details for CVE-2026-110918

Vulnerability Analysis

The vulnerability resides in Chrome's Core component, which handles foundational browser logic shared across rendering, navigation, and resource management. According to Google's advisory, a crafted HTML page triggers a memory corruption condition that permits a remote attacker to read memory contents the attacker is not entitled to access.

The weakness maps to [CWE-119], indicating that an operation reads or writes outside the intended bounds of a memory buffer. In this case, the resulting primitive is a read, which limits direct code execution potential but still exposes in-process data such as cached credentials, document content, or memory layout useful for chaining with other bugs.

Exploitation requires user interaction. A victim must load the attacker-controlled page in a vulnerable Chrome build. The attack vector is network-based and does not require authentication.

Root Cause

The root cause is improper restriction of a memory buffer operation inside the Chromium Core module. Google has not published source-level technical details while patch adoption completes. The restricted Chromium Issue Tracker entry #568937999 will contain the authoritative patch commits once Google opens the ticket.

Attack Vector

An attacker hosts a malicious HTML page containing crafted markup, scripts, or embedded resources that drive the vulnerable Core code path. When a user visits the page, Chrome processes the input and the out-of-bounds read is triggered. The attacker then exfiltrates leaked memory contents through standard web channels such as fetch, XMLHttpRequest, or side channels exposed to attacker-controlled JavaScript.

No verified public proof-of-concept, exploit module, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-110918

Indicators of Compromise

Chrome processes crashing or logging renderer anomalies shortly after loading an untrusted page
Outbound HTTP(S) requests from browser processes carrying unusually large encoded payloads to recently registered or low-reputation domains
Browser telemetry showing Chrome client versions earlier than 155.0.8059.84 on managed endpoints

Detection Strategies

Inventory Chrome versions across managed endpoints and flag any build earlier than 155.0.8059.84 as vulnerable
Correlate web proxy logs with endpoint browsing history to identify users who visited high-risk or unknown domains while running vulnerable Chrome builds
Alert on renderer process crash events (chrome.exe child-process exits with access-violation codes) that cluster around visits to the same URL

Monitoring Recommendations

Enable browser management policies that report installed version and update status to a central console
Forward endpoint process and network telemetry into a SIEM or data lake for retroactive hunting once additional indicators are published
Monitor the Chrome Releases blog for follow-up fixes and related CVEs affecting the Core component

How to Mitigate CVE-2026-110918

Immediate Actions Required

Update Google Chrome Desktop to version 155.0.8059.84 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after update installation to ensure the patched binaries are loaded into memory
Verify that automatic updates are enabled through chrome://settings/help or enterprise policy
Audit downstream Chromium-based browsers (for example, Edge, Brave, Opera, Vivaldi) and apply vendor updates that rebase onto patched Chromium

Patch Information

Google addressed the issue in the Chrome Stable channel update documented in the Google Chrome Stable Update advisory. The fixed version is 155.0.8059.84. Enterprise administrators should deploy the update through their standard software distribution channel or allow Google Update to apply it automatically. Technical details are tracked in Chromium Issue #568937999.

Workarounds

Restrict browsing to trusted sites using URL allow-lists or secure web gateways until the patch is deployed
Enable Chrome's Site Isolation and Enhanced Safe Browsing to raise the cost of exploitation and improve detection of malicious pages
Disable JavaScript on untrusted origins through enterprise policy where feasible, since the exploitation path relies on dynamic page content

bash

# Verify the installed Chrome version on Linux/macOS
google-chrome --version

# Windows (PowerShell) - query installed Chrome version
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Enterprise policy example (Linux JSON) to force update channel
# /etc/opt/chrome/policies/managed/update_policy.json
{
  "TargetVersionPrefix": "155.0.8059.84",
  "UpdateDefault": 1
}