Loading vulnerability…
DOM use-after-free in Google Chrome
CVE-2026-110164 is a use-after-free vulnerability in the DOM implementation of Google Chrome versions before 155.0.8059.79. A remote attacker can potentially trigger the vulnerability through a crafted HTML page and execute arbitrary code inside the browser sandbox. Chromium rates the vulnerability High severity. The specific vulnerable function and memory-lifetime trigger are not publicly specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could compromise the confidentiality, integrity, and availability of the affected sandboxed browser process through arbitrary code execution. This vulnerability alone does not establish sandbox escape, elevated privileges, or operating-system compromise.
If you can’t patch tonight, do this now.
No vulnerability-specific interim workaround is documented. Reduce exposure through URL filtering and restrictions on untrusted web content, retain browser sandboxing and available anti-exploitation protections, and run the browser under a non-administrative account. These defense-in-depth measures do not replace updating.
Patch, then assume compromise.
Upgrade Google Chrome to version 155.0.8059.79 or a later supported fixed release; the desktop update includes version 155.0.8059.80 for applicable Windows and Mac installations. Relaunch Chrome after updating. For distribution-managed Chromium, install the vendor's fixed packages; Debian trixie provides version 155.0.8059.79-1~deb13u1 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.