Description
Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-10-13
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A use-after-free flaw in the V8 JavaScript engine used by Google Chrome allows a remote attacker to execute arbitrary code inside the browser's sandbox via a crafted HTML page. The flaw enables code injection that could compromise confidentiality, integrity, and availability of the user's system if the sandbox is breached, and represents a classic memory corruption weakness based on CWE-416.

Affected Systems

All Google Chrome desktop installations running versions prior to 155.0.8059.79 are affected, including the stable channel builds that were released before the patch was issued.

Risk and Exploitability

The vulnerability has a CVSS score of 8.8 and an EPSS score below 1%, indicating low exploitation probability but high severity. It is not listed in CISA’s KEV catalog. Attackers would need to supply a malicious HTML page to a user’s browser, but the presence of the use-after-free bug in the sandboxed V8 engine gives them the potential to run code with the sandbox’s privileges, creating a realistic remote code execution risk.

Generated by OpenCVE AI on October 16, 2026 at 02:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 155.0.8059.79 or later via the browser’s built‑in updater.
  • Ensure the browser’s auto‑update feature is enabled so future patches are applied automatically.
  • Use Chrome’s Safe Browsing and content‑filtering extensions to reduce exposure to malicious web content that could trigger the vulnerability.

Generated by OpenCVE AI on October 16, 2026 at 02:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4838-1 chromium security update
Debian DSA Debian DSA DSA-6562-1 chromium security update
History

Wed, 14 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome

Wed, 14 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Use after free in V8
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Tue, 13 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
Description Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-15T03:56:19.561Z

Reserved: 2026-10-13T16:50:04.347Z

Link: CVE-2026-110169

cve-icon Vulnrichment

Updated: 2026-10-14T13:17:51.198Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T22:17:36.907

Modified: 2026-10-15T04:18:22.243

Link: CVE-2026-110169

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-13T21:01:45Z

Links: CVE-2026-110169 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T05:45:17Z

Weaknesses