Loading vulnerability…
Use-after-free in Google Chrome Bindings
CVE-2026-110170 is a use-after-free vulnerability in the Bindings component of Google Chrome before version 155.0.8059.79. A remote attacker can trigger the vulnerability through a crafted HTML page to read memory within the browser sandbox. Chromium classifies the vulnerability as High severity. Chromium-based Microsoft Edge is also affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation discloses memory contents within the browser sandbox, potentially exposing sensitive information held in the affected process. The CVSS 3.1 assessment indicates low confidentiality impact and no assessed integrity or availability impact. Arbitrary code execution, privilege escalation, and sandbox escape are not established for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is documented. Until updates are applied, restrict access to untrusted web content and use URL filtering to reduce exposure to malicious pages. These measures do not replace patching.
Patch, then assume compromise.
Upgrade Google Chrome to version 155.0.8059.79 or a later fixed release and relaunch the browser. Update Chromium and related packages through the operating system's supported security-update channel; Debian trixie provides a fixed package in version 155.0.8059.79-1~deb13u1 or later. Update Chromium-based Microsoft Edge to the latest available version; a CVE-specific minimum fixed Edge version is not established.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.