CVE-2026-110165 in Chrome
Summary
by MITRE • 10/13/2026
Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified as a use-after-free flaw within the core components of Google Chrome on Android, specifically affecting versions prior to 155.0.8059.79, represents a critical memory corruption issue that undermines the browser's fundamental security model. This type of error occurs when a program continues to use a pointer after it has been freed, leading to undefined behavior that can be exploited by malicious actors. In this specific instance, the flaw resides in the core rendering or processing engine, which handles complex web content and scripts. The severity is classified as critical because such memory corruption vulnerabilities often allow for arbitrary code execution with high reliability, bypassing standard mitigation techniques like stack canaries or address space layout randomization if exploited correctly through carefully crafted heap structures.
The operational impact of this vulnerability is severe due to its potential for remote exploitation via a simple HTML page. An attacker could host a malicious webpage containing specially constructed JavaScript and DOM elements designed to trigger the use-after-free condition during memory allocation and deallocation cycles within Chrome's core. When a victim visits this crafted page, the browser processes the content in a way that leaves a dangling pointer valid while pointing to freed or reallocated memory regions. By controlling the data written into these reused memory locations through subsequent allocations, an attacker can manipulate internal object states, function pointers, or vtables within the Chrome process. This manipulation enables the execution of arbitrary code outside the browser's sandbox environment, granting the attacker full control over the underlying operating system processes associated with that tab or window.
From a threat intelligence perspective, this vulnerability aligns closely with Common Weakness Enumeration (CWE) category CWE-416, which defines use after free as a situation where an application uses memory after it has been freed. This is frequently exploited in conjunction with heap spraying techniques to achieve reliable code execution. Furthermore, the exploitation path corresponds to MITRE ATT&CK technique T1203, specifically the sub-technique of exploiting vulnerabilities for client-side execution. The ability to escape the sandbox is particularly dangerous as Chrome's multi-process architecture isolates web content from sensitive system resources; bypassing this isolation allows an attacker to access cookies, local storage, and potentially escalate privileges on the Android device if other security boundaries are also compromised.
Mitigation strategies primarily involve immediate software updates to ensure users are running version 155.0.8059.79 or later of Google Chrome for Android, where this memory management issue has been resolved by correcting the lifecycle management of affected objects and ensuring pointers are nullified after deallocation. In environments where patching is not immediately feasible, network-level controls such as web filtering proxies can be configured to block access to known malicious domains hosting exploit kits or suspicious HTML payloads containing complex DOM manipulations typical of heap exploitation attempts. Additionally, enabling Chrome's built-in sandbox protections and keeping the underlying Android operating system updated with the latest security patches provides an additional layer of defense against potential post-exploitation activities stemming from this vulnerability.