Google Chrome CVE-2026-110154

Exploitation requires the victim to open an attacker-controlled crafted HTML page in a vulnerable Google Chrome build (any version prior to 155.0.8059.79) that exercises the Canvas rendering path, triggering the use-after-free. The key limiting factors are: (1) mandatory user interaction (CVSS UI:R) - the victim must navigate to or load the malicious page, so no fully automated drive-by mass exploitation (reflected in SSVC Automatable='no'); and (2) code execution is confined to the renderer sandbox per the description, meaning a successful exploit does not by itself compromise the host OS and would need to be chained with a separate sandbox-escape vulnerability for full system control. No authentication is required (PR:N).

Multiple signals must be weighed here. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (UI:R) - the victim must visit a crafted HTML page. This aligns with the use-after-free (CWE-416) in Chrome's Canvas component. CISA's SSVC framework rates Exploitation as 'none' (no observed or public exploitation), Automatable as 'no' (UI:R breaks mass drive-by automation since a user must be lured to a page), but Technical Impact as 'total' (consistent with potential arbitrary code execution). There is no CISA KEV listing and no EPSS score provided in the input, and no public POC is referenced, so this is: no public exploit identified at time of analysis. Importantly, the description explicitly states code execution is 'inside the sandbox' - i.e., no sandbox escape is claimed, which materially limits real-world impact versus a full RCE on the host; a renderer-only compromise typically requires a second chained bug to escape the sandbox. Net assessment: a genuinely serious memory-corruption bug in an ubiquitous product that should be patched promptly, but current intelligence (no KEV, no POC, SSVC Exploitation=none, UI required, sandbox-contained) points to this being a high-severity-by-score issue without evidence of imminent widespread exploitation rather than an actively-weaponized emergency. Note a conflict to verify: the input Tags include 'Denial Of Service' and 'RCE', but the primary described impact is in-sandbox code execution via UAF - treat the DoS label as a secondary/consequential effect, not the primary vector.

An attacker hosts or compromises a web page containing malicious HTML/JavaScript that drives Chrome's Canvas rendering into a use-after-free condition. When a victim running a vulnerable Chrome version (prior to 155.0.8059.79) visits the page, the freed object is reused to corrupt memory and potentially execute attacker-controlled code within the renderer sandbox. No public POC or exploit code is referenced in the available data, and the attack requires the victim to actively load the attacker's page (UI:R).