Loading vulnerability…
Sandboxed Code Execution in Google Chrome Animation
CVE-2026-110166 is a buffer overflow in Google Chrome's Animation component affecting versions before 155.0.8059.79. Processing a crafted HTML page can allow a remote attacker to execute arbitrary code inside the browser sandbox. Chromium classifies the vulnerability as High severity. The specific vulnerable function and whether the overflow affects heap or stack memory are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution within Chrome's sandbox, compromising the affected process and potentially the confidentiality, integrity, and availability of resources accessible to it. This vulnerability alone does not establish sandbox escape, operating-system compromise, or privilege escalation.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is identified. Until updates are applied, reduce exposure to untrusted web pages through URL filtering and browsing restrictions. Keep browser sandboxing and available exploit protections enabled, and run the browser under a non-administrative account. These defense-in-depth measures do not replace patching.
Patch, then assume compromise.
Upgrade Google Chrome or Chromium to version 155.0.8059.79 or a later supported fixed release, then restart the browser. For distribution-managed Chromium installations, install the applicable vendor security update. Debian stable (trixie) provides a fixed package in version 155.0.8059.79-1~deb13u1.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.