CVE-2026-110160 in Chrome
Summary
by MITRE • 10/13/2026
Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Google Chrome prior to version 155.0.8059.79 represents a critical failure in access control mechanisms within the Reading Mode feature, classified under CWE-269 as Improper Control of Interaction with Untrusted Input or more specifically as an Authorization Bypass through User Interface Misinterpretation when combined with process isolation failures. This flaw allows for a sophisticated attack vector where a remote attacker, having already achieved code execution within a sandboxed renderer process, can leverage social engineering tactics to manipulate the user into interacting with a crafted HTML page. The core technical deficiency lies in the insufficient validation of authorization checks during the transition or operation of Reading Mode, which inadvertently exposes internal browser states and navigation contexts that are typically protected by Chrome's site isolation policies.
Site isolation is a fundamental security architecture designed to prevent cross-site scripting attacks from leaking sensitive data between different origins by ensuring that each origin runs in its own unique process with isolated memory space. By bypassing this mechanism through the Reading Mode feature, an attacker can potentially access cookies, local storage, or other site-specific data belonging to third-party domains that would normally be inaccessible due to same-origin policy restrictions. The exploitation path relies heavily on social engineering because the initial compromise of the renderer is often achieved via malicious advertisements, drive-by downloads, or phishing links that trigger specific rendering behaviors without immediate user interaction beyond visiting a webpage. Once inside the renderer, the crafted HTML page exploits the missing authorization check in Reading Mode to escalate privileges within the browser context, effectively breaking down the boundaries between different web origins.
The operational impact of this vulnerability is severe as it undermines one of Chrome's most effective defenses against data exfiltration and session hijacking attacks. An attacker who successfully leverages this flaw can read sensitive information from other sites open in the same browser profile, such as financial details, personal identification numbers, or proprietary corporate data stored locally by web applications. This capability significantly increases the blast radius of a single compromised renderer process, transforming what might have been an isolated incident into a broader compromise of user privacy and security across multiple domains. The severity is rated high due to the potential for widespread data leakage and the difficulty users face in detecting such subtle manipulations within their browsing experience.
Mitigation strategies primarily involve updating Google Chrome to version 155.0.8059.79 or later, where these authorization checks have been reinforced to ensure that Reading Mode operations strictly adhere to existing site isolation boundaries. Administrators should enforce automatic update policies across all endpoints to minimize the window of exposure. Additionally, users are advised to exercise caution when interacting with unfamiliar web content and to utilize browser extensions that enhance security posture by blocking suspicious scripts or enforcing stricter privacy settings. From a defensive perspective, implementing Content Security Policy headers on hosted applications can further limit the impact if such an exploit is attempted, although this does not replace the need for patching the underlying browser vulnerability. This incident highlights the importance of rigorous code review processes in features that interact with core security mechanisms like site isolation to prevent privilege escalation paths from emerging through seemingly benign user interface elements.