Loading vulnerability…
Sandboxed Code Execution via Use-After-Free in Google Chrome V8
CVE-2026-110919 is a use-after-free vulnerability in the V8 JavaScript engine in Google Chrome before version 155.0.8059.84. A remote attacker can trigger the flaw through a crafted HTML page to execute arbitrary code inside the browser sandbox. Chromium classifies the vulnerability as High severity. The specific vulnerable function and memory-lifetime error have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows attacker-controlled code to execute within Chrome's sandbox, compromising the affected sandboxed execution context. The vulnerability alone does not establish a sandbox escape or unrestricted execution on the host operating system.
If you can’t patch tonight, do this now.
No vulnerability-specific interim workaround is specified.
Patch, then assume compromise.
Upgrade Google Chrome to version 155.0.8059.84 or later, using the applicable fixed release for the platform: 155.0.8059.84/.85 for Windows and macOS, or 155.0.8059.84 for Linux. Restart the browser to complete installation and verify the installed version. For distribution-packaged Chromium, install the vendor security update incorporating Chromium 155.0.8059.84 or later and follow any required session restart instructions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.