Loading vulnerability…
Sandboxed Code Execution in Google Chrome V8
CVE-2026-110920 is a high-severity memory corruption vulnerability in the V8 engine in Google Chrome versions before 155.0.8059.84. A remote attacker can trigger the vulnerability through a crafted HTML page and execute arbitrary code within the browser sandbox. The specific vulnerable function and underlying memory corruption mechanism have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution within the Chrome sandbox, compromising the affected sandboxed process. This vulnerability alone does not establish sandbox escape or code execution with unrestricted operating-system access.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary mitigation or workaround has been specified.
Patch, then assume compromise.
Upgrade Google Chrome to version 155.0.8059.84 or later. The associated fixed Stable releases are 155.0.8059.84/.85 for Windows and macOS and 155.0.8059.84 for Linux. Restart Chrome to complete installation and verify the installed version. For distribution-packaged Chromium, install the vendor security update incorporating Chromium 155.0.8059.84 or later and complete any required session restart.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.