CVE-2026-110159 in Chrome
Summary
by MITRE • 10/13/2026
Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified as an incorrect authorization issue within the updater component of Google Chrome, specifically affecting versions prior to 155.0.8059.79, represents a critical failure in access control mechanisms that governs how system-level updates are processed and executed. This flaw resides in the privilege escalation path where the browser's update mechanism interacts with the operating system’s higher-privileged processes. The core technical deficiency lies in the improper validation of authorization tokens or permissions when launching local programs associated with the update process. Instead of strictly enforcing least-privilege principles, the updater allows a local attacker to manipulate the execution context, thereby bypassing the intended security boundaries that isolate browser activities from the underlying operating system kernel and file system.
From a technical perspective, this vulnerability exploits the trust relationship between the user-level Chrome processes and the elevated privileges required for installing updates or modifying protected system directories. An attacker who has achieved local access to the victim’s machine can craft specific inputs or exploit race conditions within the updater logic to execute arbitrary code with higher privileges than those granted to the standard browser sandbox. This effectively neutralizes the security sandbox, which is Chrome's primary defense against remote code execution and data exfiltration attacks. By leveraging this flaw, an attacker can transition from a low-privilege user context to one that permits system-wide modifications, potentially installing persistent malware, stealing sensitive credentials stored in higher-privileged contexts, or disabling security software protections.
The operational impact of this vulnerability is severe due to its potential for privilege escalation and sandbox escape. While the initial vector requires local access, which typically implies a lower severity than remote exploits, the ability to execute arbitrary code outside the sandbox fundamentally compromises the integrity of the entire system environment protected by Chrome’s isolation model. This means that even if an attacker initially gained entry through a less severe vulnerability or physical access, this updater flaw serves as a powerful tool for escalating their privileges to administrator or SYSTEM level. Consequently, organizations relying on Google Chrome for secure browsing face significant risks regarding data confidentiality and system integrity if they do not promptly apply the security patches provided in version 155.0.8059.79 or later.
In terms of industry standards classification, this vulnerability aligns with CWE-269, which denotes Improper Privilege Assignment, as it involves granting excessive permissions to a process that should operate under restricted privileges. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic T1055, specifically Process Injection or T1053 Scheduled Task/Job, depending on how the arbitrary code is executed within the system context. The attack vector also relates to CWE-284 Improper Access Control, highlighting the failure in verifying that the entity requesting the action has the appropriate rights to perform it. These classifications underscore the severity of bypassing sandbox boundaries and highlight the importance of rigorous authorization checks in software components with elevated privileges.
To mitigate this risk, immediate patching is required by upgrading Google Chrome to version 155.0.8059.79 or any subsequent release that addresses this specific updater flaw. Administrators should ensure that automatic update mechanisms are enabled and functioning correctly to prevent exposure during the window between vulnerability disclosure and remediation. Additionally, implementing strict endpoint detection and response policies can help identify anomalous behavior associated with privilege escalation attempts via browser components. Regular audits of local user permissions and monitoring for unauthorized modifications to system directories or scheduled tasks related to Chrome updates will further reduce the attack surface available to potential local attackers seeking to exploit this authorization bypass.