Loading vulnerability…
Use-after-free in Google Chrome Compositing
CVE-2026-110915 is a use-after-free vulnerability in the Compositing component of Google Chrome before version 155.0.8059.84. A remote attacker can trigger the flaw through a crafted HTML page to execute arbitrary code inside the browser sandbox. Chromium classifies the vulnerability as Medium severity. The specific vulnerable function and memory-lifetime conditions have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution within the Chrome sandbox. The vulnerability alone does not establish a sandbox escape, host-level code execution, or access beyond the sandbox's permissions.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround has been specified.
Patch, then assume compromise.
Upgrade Google Chrome to version 155.0.8059.84 or later, using the applicable fixed release for the operating system, and restart the browser to activate the update. For distribution-packaged Chromium, install the vendor's security update incorporating Chromium 155.0.8059.84 or later. Fedora package advisories additionally instruct users to log out and log back in after installation. Verify that managed devices have received the fixed release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.