Description
Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
Published: 2026-10-13
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary code execution
Action: Patch Immediately
AI Analysis

Impact

A flaw in the Mojo authorization logic in Google Chrome on Windows, categorized as CWE‑863 (Improper Authorization), permits a local attacker to execute arbitrary code outside the sandbox by exploiting a local program.

Affected Systems

The issue affects Chrome versions prior to 155.0.8059.79 on Windows. All users running those builds of Chrome are impacted.

Risk and Exploitability

The CVSS score of 9.6 indicates high severity, while an EPSS score of < 1% suggests that exploit prevalence is low at present. The vulnerability is not currently listed in CISA KEV. The likely attack vector is local, requiring the attacker to run a program that can interact with Chrome via Mojo; no remote or network access is required.

Generated by OpenCVE AI on October 16, 2026 at 02:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome to version 155.0.8059.79 or later, which contains the fix for the Mojo authorization flaw.
  • If a patch is not immediately available, restrict local applications from invoking Chrome’s Mojo interfaces by disabling the relevant Chrome extensions or using AppContainer sandboxing.
  • Regularly check Google Chrome release notes and security advisories for updates that address Mojo-related vulnerabilities.

Generated by OpenCVE AI on October 16, 2026 at 02:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4838-1 chromium security update
Debian DSA Debian DSA DSA-6562-1 chromium security update
History

Wed, 14 Oct 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome
Microsoft
Microsoft windows

Wed, 14 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Wed, 14 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Incorrect authorization in Mojo
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Tue, 13 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
Description Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
Weaknesses CWE-863
References

Subscriptions

Google Chrome
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-15T03:56:28.002Z

Reserved: 2026-10-13T16:48:54.280Z

Link: CVE-2026-110144

cve-icon Vulnrichment

Updated: 2026-10-14T13:15:14.894Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T22:17:34.203

Modified: 2026-10-15T04:18:17.963

Link: CVE-2026-110144

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-13T21:01:43Z

Links: CVE-2026-110144 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T20:45:14Z

Weaknesses