Google Chrome CVE-2026-110922

Exploitation requires the victim to use Google Chrome prior to 155.0.8059.84 and to navigate to an attacker-controlled page containing crafted HTML that exercises the Prerender feature; this user interaction (UI:R) is the primary limiting factor, as the attacker cannot trigger the flaw without the user loading the malicious content. No authentication or special privileges are needed (PR:N) and no non-default configuration is indicated - Prerender is standard Chrome functionality. The most significant limit on impact is that resulting code execution is confined to the renderer sandbox (S:U), so full system compromise would additionally require a separate sandbox-escape vulnerability.

This is a credible high-priority patching target but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (visiting a crafted page), with high confidentiality, integrity and availability impact and no scope change (S:U) - consistent with code execution confined to the renderer sandbox as the description states. Chromium rates the severity Critical, and SSVC lists Technical Impact as 'total,' reinforcing the memory-corruption RCE classification. However, the signals do NOT indicate active or imminent mass exploitation: SSVC Exploitation is 'none,' the CVE is not listed in CISA KEV, Automatable is 'no,' and no EPSS score or public POC was provided in the input - so there is no public exploit identified at time of analysis. The practical ceiling on impact is the sandbox: the description explicitly says code runs 'inside the sandbox,' meaning a second sandbox-escape bug would be needed for full host compromise, which the CVSS A:H/I:H/C:H arguably overstates for host-level risk. Net: patch promptly given ubiquity and Critical rating, but current real-world exploitation risk is lower than the 8.8 alone suggests.

An attacker hosts or compromises a web page containing specially crafted HTML that abuses Chrome's Prerender feature; when a victim using a vulnerable Chrome build (prior to 155.0.8059.84) browses to it, the use-after-free is triggered and attacker-controlled code executes within the renderer sandbox. No authentication is required (PR:N) and complexity is low (AC:L), but the victim must actively load the malicious page (UI:R), and no public exploit code was identified in the provided data.