Description
Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-10-15
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

An input‑validation flaw in Chrome's desktop component allows a remote attacker to craft an HTML page that can execute arbitrary code outside the browser sandbox. The flaw is a classic CWE‑20 Boundary Error that, if exploited, gives the attacker full access to the host system, including reading, writing, and process execution, leading to complete compromise of the user’s machine.

Affected Systems

The vulnerability exists in Google Chrome Desktop versions older than 155.0.8059.84 on all supported operating systems. Any machine running one of these versions and accessing a maliciously constructed web page is susceptible.

Risk and Exploitability

Chromium rates this issue as Medium severity, but the CVSS score of 9.6 indicates a critical risk. The EPSS score is < 1%, and it is not listed in the CISA KEV catalog, suggesting limited exploitation so far. However, the attack vector requires the user to open or view a crafted HTML page, making phishing a likely delivery mechanism. Given the potential to escape the sandbox, the risk remains high for exposed systems.

Generated by OpenCVE AI on October 16, 2026 at 20:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Chrome to version 155.0.8059.84 or later.
  • If an update is not immediately possible, restrict access to untrusted web content by disabling scripting or applying a whitelist policy.
  • Ensure Chrome’s built‑in sandboxing features remain enabled.
  • Use reputable anti‑phishing tools and monitor for suspicious web pages.

Generated by OpenCVE AI on October 16, 2026 at 20:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Mon, 19 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Sat, 17 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 17 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Sat, 17 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Improper Input Validation in Chrome Desktop chromium-browser: Improper input validation in Desktop
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 16 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Improper Input Validation in Chrome Desktop

Fri, 16 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Fri, 16 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Improper Input Validation in Chrome

Fri, 16 Oct 2026 08:00:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Improper Input Validation in Chrome

Thu, 15 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
Description Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-20
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-16T18:41:56.043Z

Reserved: 2026-10-15T04:31:41.302Z

Link: CVE-2026-110916

cve-icon Vulnrichment

Updated: 2026-10-16T01:25:59.620Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-15T22:19:26.943

Modified: 2026-10-19T19:04:43.797

Link: CVE-2026-110916

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-15T22:04:19Z

Links: CVE-2026-110916 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T13:00:09Z

Weaknesses
  • CWE-20

    Improper Input Validation