Loading vulnerability…
Memory disclosure through memory corruption in Google Chrome Core
CVE-2026-110918 is a high-severity memory corruption vulnerability in the Core component of Google Chrome before version 155.0.8059.84. A remote attacker can trigger the vulnerability through a crafted HTML page to read browser memory. The precise vulnerable function and underlying memory corruption mechanism have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation exposes browser memory contents to a remote attacker, potentially disclosing sensitive information. The accessible memory range and specific data exposed are not established. Arbitrary code execution, sandbox escape, and integrity or availability impacts are not established for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Updating to a fixed release is the supported corrective action.
Patch, then assume compromise.
Upgrade Google Chrome to version 155.0.8059.84 or later; the corresponding platform releases are 155.0.8059.84/.85 for Windows and macOS and 155.0.8059.84 for Linux. Restart the browser to complete installation and verify the installed version. For distribution-managed Chromium installations, apply the vendor security update containing Chromium 155.0.8059.84 or later and follow any required session-restart instructions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.