CVE-2026-110170 in Chrome
Summary
by MITRE • 10/13/2026
Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified as a use-after-free condition within the Bindings component of Google Chrome prior to version 155.0.8059.79 represents a critical memory safety flaw that undermines the browser's sandboxing architecture. This specific class of error occurs when an application continues to reference a pointer after the memory it points to has been freed and potentially reallocated for other purposes. In the context of Chromium-based browsers, the Bindings layer serves as the bridge between JavaScript code running in untrusted web pages and the privileged native components that handle core browser functionalities. When this interface fails to properly manage object lifecycles, a dangling pointer remains accessible to malicious scripts even after the underlying C++ object has been destroyed or its memory released back to the system allocator.
From an operational perspective, this flaw allows a remote attacker to achieve arbitrary read access within the sandboxed renderer process environment through a specially crafted HTML page. The attack vector typically involves hosting a webpage that triggers the specific sequence of events leading to premature deallocation while maintaining references to those freed objects via JavaScript bindings. By carefully controlling memory allocation patterns after the free operation, an attacker can force the system to allocate sensitive data into the same memory location previously occupied by the vulnerable object. Subsequent access through the dangling pointer then reveals this newly allocated content, effectively bypassing isolation boundaries that are designed to prevent cross-origin data leakage or sandbox escape.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-416, which describes use after free as a situation where an application uses memory after it has been freed, leading to undefined behavior and potential security breaches. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic T1059, specifically sub-technique 007 for JavaScript execution, combined with techniques related to unauthorized access to system resources such as T1005 or data exfiltration methods that rely on memory scraping within constrained environments. The severity is classified as High because it facilitates information disclosure from a context where the attacker should have no visibility into internal browser states or other tab contents due to strict sandboxing policies.
Mitigation for this vulnerability requires immediate updating of Google Chrome and all Chromium-based browsers to version 155.0.8059.79 or later, which includes patches that enforce stricter lifetime management protocols within the Bindings layer. Developers implementing similar architectures should adopt smart pointer mechanisms such as std::shared_ptr with custom deleters or explicit lifecycle tracking interfaces like v8::Global handles in V8 engine integrations to ensure objects are not accessed after their intended scope ends. Additionally, enabling memory safety features provided by modern compilers and operating systems, including AddressSanitizer during development and hardware-enforced stack canaries on deployment targets, provides an additional layer of defense against exploitation attempts involving dangling pointers.