Loading vulnerability…
Potential Sandbox Escape in Google Chrome Desktop
CVE-2026-110916 is an improper input validation vulnerability in the Desktop component of Google Chrome before version 155.0.8059.84. A remote attacker could use a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. Chromium classifies the vulnerability as Medium severity. The specific vulnerable function and input-validation failure have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could permit arbitrary code execution outside the Chrome sandbox, compromising browser isolation and potentially affecting the confidentiality, integrity, and availability of resources accessible to the executing process. Elevated operating-system privileges are not established.
If you can’t patch tonight, do this now.
No vulnerability-specific interim workaround is documented. Updating to a security-fixed browser release is the recommended action.
Patch, then assume compromise.
Upgrade Chrome to a fixed release: 155.0.8059.84 or later on Windows and Linux, or 155.0.8059.85 or later on macOS. Restart Chrome to complete installation and verify the installed version across managed devices. For Chromium installations, apply the distribution-provided security update incorporating version 155.0.8059.84 or later. Fedora advisories additionally require logging out and back in after installing the update.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.