CVE-2026-110142 in Chrome
Summary
by MITRE • 10/13/2026
Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified as a use-after-free flaw within the FileSystem component of Google Chrome prior to version 155.0.8059.79 represents a critical memory safety issue that undermines the browser's core isolation mechanisms. This type of error occurs when a program continues to use a pointer after the memory it points to has been freed, leading to undefined behavior that can be exploited by malicious actors. In this specific instance, the flaw resides in how Chrome manages resources associated with file system operations, where an object is deallocated but remains accessible through lingering references within the application's internal state management structures.
The operational impact of this vulnerability is severe due to its potential for remote code execution outside the browser sandbox. Attackers can craft a malicious HTML page that triggers the specific sequence leading to the use-after-free condition when processed by the vulnerable version of Chrome. By carefully controlling the timing and content of memory allocations following the deallocation, an attacker can manipulate the freed memory region to contain controlled data or shellcode. This allows for arbitrary code execution with the privileges of the user running the browser, effectively bypassing the sandbox protections designed to limit the damage from web-based attacks.
From a classification perspective, this vulnerability aligns closely with CWE-416, which defines use-after-free errors as a subset of improper resource management. The exploitation vector is categorized under ATT&CK technique T1203, specifically targeting exploit code execution via browser vulnerabilities. The medium severity rating assigned by the Chromium team reflects the complexity required to reliably trigger the condition and achieve stable memory corruption, yet it remains highly dangerous given the widespread adoption of Chrome and its role as a primary gateway for internet access on many systems.
Mitigation strategies primarily involve immediate software updates to ensure that all instances of Google Chrome are upgraded to version 155.0.8059.79 or later, where these memory management issues have been resolved through rigorous code review and automated fuzzing tests. For organizations unable to patch immediately, implementing strict content security policies can help mitigate the risk by restricting the execution of untrusted scripts and limiting access to local file system APIs that might be leveraged in such an attack chain. Additionally, enabling sandbox enforcement features and keeping operating system-level protections active provides a secondary layer of defense against potential exploitation attempts.