CVE-2026-110159

9.6Critical

Published 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash

9.6Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-863

Impact

A local attacker can escape the sandbox and execute arbitrary code on the host. They need to run a local program on the target machine to exploit it.

Root cause

Incorrect authorization checks in the Google Chrome Updater component allow sandbox escape.

Affected systems

Google Chrome prior to 155.0.8059.79

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Fix & remediation

Upgrade Google Chrome to version 155.0.8059.79 or later. No workarounds or interim mitigations are provided, so prioritize deploying the package update.

shell

$ google-chrome --version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

References

https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.htmlRelease NotesVendor Advisory
https://issues.chromium.org/issues/564573066Permissions Required

Source: nvd.nist.gov/vuln/detail/CVE-2026-110159