Loading vulnerability…
Memory corruption in Google Chrome Workers
CVE-2026-110914 is a memory corruption vulnerability in the Workers component of Google Chrome before version 155.0.8059.84. A remote attacker can potentially trigger the flaw through a crafted HTML page and execute arbitrary code within the browser sandbox. Chromium classifies the vulnerability as Medium severity. The specific vulnerable function and memory corruption mechanism are not publicly detailed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could allow arbitrary code execution within the Chrome sandbox. Sandbox escape, host-level code execution, and privilege escalation are not established consequences of this vulnerability alone.
If you can’t patch tonight, do this now.
No vulnerability-specific interim workaround is documented.
Patch, then assume compromise.
Upgrade Google Chrome to version 155.0.8059.84 or later, using the applicable fixed platform release; the announced Windows and macOS releases include 155.0.8059.84/.85. Restart Chrome to complete installation and verify the installed version. For distribution-managed Chromium, install the vendor security update containing Chromium 155.0.8059.84 or later. Fedora advisories additionally require logging out and back in after installation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.