CVE-2026-110144 in Chrome
Summary
by MITRE • 10/13/2026
Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified as an incorrect authorization flaw within Mojo, the inter-process communication framework used by Google Chrome on Windows prior to version 155.0.8059.79, represents a significant breach in the browser's sandboxing architecture. This issue stems from improper access control checks that allow local programs to bypass expected restrictions when interacting with Chrome processes via Mojo interfaces. In modern web browsers like Chrome, security is heavily reliant on process isolation and strict privilege boundaries to prevent malicious content or compromised plugins from affecting the host system. The flaw essentially permits a local attacker who has already achieved some level of code execution within the browser's sandboxed environment to escalate privileges by exploiting these authorization gaps in Mojo IPC mechanisms.
From a technical perspective, this vulnerability falls under the category of improper privilege management and access control bypasses. It aligns with CWE-269, which describes Improper Privilege Management, specifically where an actor is able to perform actions beyond their intended permissions due to flawed logic or missing checks in the authorization layer. The attacker leverages a local program that interacts with Chrome through Mojo channels. Because the authorization check was insufficient, the malicious program could invoke methods or access resources within higher-privilege processes without proper validation of its own rights. This effectively allows code execution outside the intended sandbox boundary, which is designed to contain potential threats and limit their impact on the operating system and user data.
The operational impact of this vulnerability is severe due to its high severity rating in Chromium's security model. By executing arbitrary code outside the sandbox, an attacker gains capabilities that extend beyond typical web-based attacks. This could include reading sensitive files stored locally, installing persistent malware, or pivoting to attack other systems on the network if the compromised machine serves as a gateway. The ability to escape the browser sandbox undermines one of the primary defenses against drive-by downloads and malicious script execution, significantly increasing the risk profile for users running affected versions of Chrome on Windows.
To mitigate this vulnerability, organizations and individual users must ensure that Google Chrome is updated to version 155.0.8059.79 or later immediately upon availability. This update contains patches that correct the authorization logic within Mojo IPC handlers, ensuring that local programs are properly authenticated before being granted access to privileged operations. Additionally, defense-in-depth strategies should be employed, such as restricting user privileges on workstations and utilizing application whitelisting tools like Windows Defender Application Control or AppLocker to prevent unauthorized executables from interacting with browser processes even if the underlying vulnerability were present in other contexts. Regular patch management cycles are critical to addressing such high-severity flaws before they can be exploited by threat actors leveraging ATT&CK techniques related to privilege escalation and defense evasion, specifically those involving local process manipulation and sandbox escape mechanisms.