CVE-2026-110916

9.6Critical

Published 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

9.6Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-20

Impact

A remote attacker can execute arbitrary code outside the sandbox if a user visits a crafted HTML page. They require no privileges, only convincing a user to open the malicious link.

Root cause

Improper input validation in Google Chrome Desktop allows escape from the browser sandbox.

Affected systems

Google Chrome for Desktop prior to 155.0.8059.84

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Fix & remediation

Update Google Chrome to version 155.0.8059.84 or later. No workarounds or interim mitigations are provided, so upgrading the browser is required.

shell

$ google-chrome --version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110916