CVE-2026-110921: Google Chrome V8 Use After Free Vulnerability

CVE-2026-110921 Overview

CVE-2026-110921 is a use-after-free vulnerability [CWE-416] in the V8 JavaScript engine used by Google Chrome. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. Google addressed the flaw in Chrome 155.0.8059.84 through the stable channel update released by the Chrome team. The issue is tracked as Chromium Issue #569286602 and classified as High severity by the Chromium security team.

Critical Impact
Successful exploitation leads to arbitrary code execution within the Chrome renderer sandbox, giving attackers a foothold for further sandbox escape chains or data theft from browsing sessions.

Affected Products

Google Chrome Desktop (Windows, macOS, Linux) prior to 155.0.8059.84
Chromium-based builds bundling the vulnerable V8 engine version
Downstream browsers that embed the affected V8 release before applying the Chromium patch

Discovery Timeline

2026-10-15 - CVE-2026-110921 published to the National Vulnerability Database
2026-10-19 - NVD entry last modified with updated references

Technical Details for CVE-2026-110921

Vulnerability Analysis

The flaw is a use-after-free condition in V8, the JavaScript and WebAssembly engine that powers Chrome. V8 manages JavaScript objects on a garbage-collected heap. When object lifetime tracking fails, a pointer can continue to reference memory that has already been freed and reallocated. An attacker who triggers the condition from JavaScript running on a crafted HTML page can control the contents of the reused memory region. This primitive is typically escalated into type confusion and arbitrary read/write within the renderer process. The result is arbitrary code execution inside the Chrome sandbox, which attackers often chain with a separate sandbox escape to achieve full system compromise.

Root Cause

The root cause is improper object lifetime management inside V8 [CWE-416]. A reference to a V8 heap object persists after the object has been freed by the garbage collector or an explicit release path. Subsequent allocations reuse the memory, letting attacker-controlled data occupy the freed slot. The dangling reference is then dereferenced as if it still held the original object type.

Attack Vector

Exploitation requires network access and user interaction. The victim must load an attacker-controlled HTML page in a vulnerable Chrome build. This is commonly achieved through phishing links, malicious advertisements, or compromised websites serving the exploit script. No credentials or prior access are required. Once the renderer is compromised, attackers execute code inside the sandbox and typically pivot to a second-stage sandbox escape.

No public proof-of-concept exploit is listed for this CVE at the time of publication. See the Google Chrome Stable Update advisory and Chromium Issue #569286602 for technical references.

Detection Methods for CVE-2026-110921

Indicators of Compromise

Chrome renderer processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters on macOS and Linux.
Browser crashes or renderer termination events correlated with visits to untrusted or newly registered domains.
Outbound connections from the Chrome process to unknown command-and-control endpoints shortly after page loads.

Detection Strategies

Inventory Chrome installations and alert on versions earlier than 155.0.8059.84 across managed endpoints.
Monitor for anomalous process trees originating from chrome.exe or the Chrome helper processes.
Correlate browser crash telemetry with web proxy logs to identify pages triggering V8 faults.

Monitoring Recommendations

Ingest browser version telemetry into the SIEM and build dashboards tracking patch compliance.
Enable web content filtering and inspect script-heavy traffic from uncategorized domains.
Capture EDR process lineage and memory alerts for Chrome renderer processes to catch post-exploitation behavior.

How to Mitigate CVE-2026-110921

Immediate Actions Required

Update Google Chrome to version 155.0.8059.84 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after patch deployment to ensure the vulnerable V8 engine is no longer loaded in memory.
Push the update through enterprise management tooling such as Chrome Browser Cloud Management or MDM policies.

Patch Information

Google released the fix in the Chrome Stable channel. Deploy build 155.0.8059.84 or newer as documented in the Google Chrome Stable Update advisory. Chromium-derived browsers must pick up the corresponding upstream patch before they can be considered remediated.

Workarounds

Restrict JavaScript execution on untrusted sites through enterprise Chrome policies until patching completes.
Enforce Site Isolation and the Chrome sandbox; do not run Chrome with --no-sandbox.
Use URL filtering and DNS controls to block access to known malicious or newly registered domains.

bash

# Verify the installed Chrome version on Linux and macOS
google-chrome --version
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Example Windows registry policy to force automatic updates via Chrome Browser Cloud Management
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f