CVE-2026-110922: Google Chrome Use After Free Vulnerability

CVE-2026-110922 Overview

CVE-2026-110922 is a use-after-free vulnerability [CWE-416] in the Prerender component of Google Chrome. The flaw affects Chrome versions prior to 155.0.8059.84 and allows a remote attacker to execute arbitrary code inside the browser sandbox. Exploitation requires the victim to load a crafted HTML page. Google's Chromium team assigned this issue a Critical security severity rating internally, while NVD scores it 8.8 (HIGH).

Critical Impact
A remote attacker can execute arbitrary code inside the Chrome renderer sandbox by convincing a user to visit a malicious or compromised web page.

Affected Products

Google Chrome Desktop versions prior to 155.0.8059.84
Chromium-based browsers using the vulnerable Prerender implementation
All operating systems supported by the Chrome Stable channel (Windows, macOS, Linux)

Discovery Timeline

2026-10-15 - CVE-2026-110922 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-110922

Vulnerability Analysis

The vulnerability resides in Chrome's Prerender subsystem, which speculatively loads and renders pages the user is likely to visit next. A use-after-free condition occurs when the Prerender component continues to access memory that has already been released. An attacker who controls the content served to the prerender context can trigger the dangling reference and influence the freed memory region. Successful exploitation yields arbitrary code execution within the renderer process, which operates inside Chrome's sandbox. Attackers typically chain renderer sandbox escapes with a second vulnerability to obtain code execution outside the sandbox boundary.

Root Cause

The root cause is improper object lifetime management in the Prerender code path, categorized as CWE-416 (Use After Free). An object is freed while another code path retains a pointer to it, and later dereferences that pointer. See Chromium Issue Tracker #568719351 for the restricted upstream bug entry.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a crafted HTML page or delivers it through a compromised site, malvertising, or a redirect. When the victim navigates to the page, Chrome's Prerender logic processes the attacker-controlled content and triggers the dangling reference. No privileges are required on the target system. Public proof-of-concept code is not available as of the publication date, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-110922

Indicators of Compromise

Unexpected chrome.exe or Google Chrome Helper (Renderer) child processes spawning additional binaries or shells after visiting a web page
Renderer process crashes with heap corruption signatures in Windows WER, macOS CrashReporter, or Linux core dumps
Outbound connections from Chrome renderer processes to uncategorized or newly registered domains

Detection Strategies

Inventory Chrome versions across the fleet and flag any instance below 155.0.8059.84 for immediate remediation
Monitor endpoint telemetry for anomalous process trees originating from browser renderer processes, including script interpreters, LOLBins, or persistence mechanisms
Correlate web proxy logs with endpoint execution events to identify malicious URLs that trigger post-exploitation activity

Monitoring Recommendations

Enable browser crash reporting and forward crash metadata to a central SIEM for analysis of exploitation attempts
Track execution of unsigned or newly created binaries written by Chrome processes to user-writable directories
Alert on Chrome processes loading unusual modules or performing memory operations consistent with exploit staging

How to Mitigate CVE-2026-110922

Immediate Actions Required

Update Google Chrome to version 155.0.8059.84 or later on all managed endpoints
Force a browser restart to ensure the patched binary is loaded into memory
Audit extensions and remove any that disable the sandbox or site isolation protections

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Desktop Update. Administrators should deploy version 155.0.8059.84 or newer. Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should be updated once their vendors ship the corresponding upstream merge.

Workarounds

Disable prerendering via enterprise policy by setting NetworkPredictionOptions to 2 (Do not predict actions)
Enforce Site Isolation and strict sandboxing through Chrome enterprise policies to reduce renderer compromise impact
Restrict browsing to trusted domains using DNS filtering or secure web gateways until patch deployment completes

bash

# Chrome enterprise policy to disable network prediction / prerendering
# Windows (registry)
reg add "HKLM\Software\Policies\Google\Chrome" /v NetworkPredictionOptions /t REG_DWORD /d 2 /f

# macOS (plist)
defaults write com.google.Chrome NetworkPredictionOptions -int 2

# Linux (JSON policy under /etc/opt/chrome/policies/managed/)
# { "NetworkPredictionOptions": 2 }