Loading vulnerability…
Use-after-free in Google Chrome Canvas
CVE-2026-110154 is a high-severity use-after-free vulnerability in the Canvas component of Google Chrome versions before 155.0.8059.79. Processing a crafted HTML page can trigger the vulnerability, potentially allowing a remote attacker to execute arbitrary code inside the browser sandbox. The specific vulnerable function and memory-lifetime conditions are not publicly specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could compromise confidentiality, integrity, and availability within the affected sandboxed browser process through arbitrary code execution. This vulnerability alone does not establish a sandbox escape, privilege escalation, or operating-system compromise.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Restrict access to untrusted websites through URL filtering, retain browser sandboxing and available exploit protections, and run the browser under a non-administrative account. These defense-in-depth measures do not replace updating.
Patch, then assume compromise.
Upgrade Google Chrome to version 155.0.8059.79 or a later supported release and relaunch the browser. For Debian Chromium, install version 155.0.8059.79-1~deb12u1 on bookworm, 155.0.8059.79-1~deb13u1 on trixie, or 155.0.8059.79-1 on sid, or a later fixed package. Use the applicable vendor security update for other Chromium distributions; no fixed Debian forky package is identified.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.