Loading vulnerability…
Uninitialized-variable memory disclosure in Google Chrome ThirdParty lmza_sdk
CVE-2026-110143 is a use-of-uninitialized-variable vulnerability in Google Chrome's ThirdParty lmza_sdk component affecting versions before 155.0.8059.79. Processing a crafted file could allow a remote attacker to read memory within the browser sandbox. Chromium rates the vulnerability High. The specific vulnerable function is not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could disclose memory within Chrome's sandbox, potentially exposing sensitive information held by the affected process. The CVSS v3 assessment assigns low confidentiality impact and no integrity or availability impact. Sandbox escape, arbitrary code execution, and operating-system compromise are not established for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Avoid opening untrusted files and restrict unnecessary downloads and attachments to reduce exposure to crafted files. Retain browser sandboxing and other available exploit protections. These measures do not replace patching.
Patch, then assume compromise.
Upgrade Google Chrome to version 155.0.8059.79 or a later supported fixed release and relaunch the browser. For distribution-managed Chromium, install the applicable vendor security update; Debian stable (trixie) provides version 155.0.8059.79-1~deb13u1 or later. Verify the installed version after updating.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.