Loading vulnerability…
Sandboxed Remote Code Execution in Google Chrome DOM
CVE-2026-110163 is a high-severity use-after-free vulnerability in the DOM implementation of Google Chrome before version 155.0.8059.79. Processing a crafted HTML page can allow a remote attacker to execute arbitrary code inside the browser sandbox. The specific vulnerable function and object-lifetime sequence are not available. This vulnerability does not establish a sandbox escape.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises code execution within the browser sandbox, potentially affecting the confidentiality, integrity, and availability of resources accessible to the compromised process. Execution outside the sandbox, operating-system takeover, and privilege escalation are not established for this vulnerability alone.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is identified. Reduce exposure by filtering malicious or unapproved websites, restricting unnecessary JavaScript and extensions where operationally appropriate, and avoiding untrusted links and pages. Retain browser sandboxing and available exploit protections, and run the browser without administrative privileges. These measures do not replace patching.
Patch, then assume compromise.
Upgrade Google Chrome to version 155.0.8059.79 or a later applicable fixed release and relaunch the browser. For distribution-managed Chromium, install the vendor's fixed packages. Debian fixed versions include 155.0.8059.79-1~deb12u1 for bookworm, 155.0.8059.79-1~deb13u1 for trixie, and 155.0.8059.79-1 for sid. A forky-specific fixed version is not identified.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.