Google Chrome CVE-2026-110149

Exploitation requires the victim to open attacker-controlled content - a crafted HTML page - in a vulnerable Chrome desktop build prior to 155.0.8059.79 (CVSS UI:R). No authentication or prior access is needed (PR:N), and default configurations are affected since merely rendering the malicious page triggers the use-after-free in the Browser process. The notable limiting factor is the required user interaction (the victim must navigate to or load the malicious page); there is no indication a non-default setting or feature flag is needed. The sandbox escape (S:C) means successful exploitation reaches the host beyond the browser's renderer sandbox.

This is a genuine high-priority vulnerability, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) is internally consistent with the description: a network-reachable, low-complexity, unauthenticated use-after-free (CWE-416) that achieves code execution OUTSIDE the Chrome sandbox (S:C scope change) with only user interaction required (UI:R - visiting a page). Google/Chromium rated it Critical, which aligns with the sandbox-escape claim. The single meaningful mitigating factor is UI:R: the victim must open attacker-controlled content. Key signals are MISSING or conflicting: no EPSS score was provided, so exploitation probability cannot be quantified; there is no CISA KEV listing in the input, so there is no confirmed active exploitation; and no POC/exploit-code indicator was supplied, so public exploit availability is unknown. No SSVC decision data was provided. Browser renderer/UAF bugs are historically among the most frequently weaponized bug classes once technical details circulate, so despite the absence of KEV/EPSS/POC signals the latent risk is high. Treat the missing EPSS and the absence of KEV as data gaps rather than evidence of low risk - verify current KEV status and EPSS directly, as this is exactly the profile that is often added to KEV shortly after disclosure.

An attacker hosts or injects a crafted HTML page (e.g., via a malicious site, compromised ad, or phishing link) and lures a victim into opening it in a vulnerable Chrome build. Rendering the page triggers a use-after-free in the Browser process, and because the flaw executes code outside the sandbox (scope change), the attacker gains arbitrary code execution on the host with the user's privileges. No public exploit was identified in the provided data, so this scenario reflects the described capability rather than observed in-the-wild activity.