CVE-2026-110918: 
Google Chrome vulnerability analysis and mitigation

CVE-2026-110918 is a memory corruption vulnerability in the Core component of Google Chrome that allows a remote attacker to read memory via a crafted HTML page. It affects all versions of Google Chrome prior to 155.0.8059.84. The vulnerability was reported by Google on 2026-10-03 and publicly disclosed on 2026-10-15 alongside a stable channel update. It carries a CVSS v3.1 base score of 4.3 (Medium), though Google rates its internal severity as High (Chrome Release, GitHub Advisory).

The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), meaning Chrome's Core component performs memory operations that read from locations outside the intended buffer boundary (GitHub Advisory). An unauthenticated remote attacker can exploit this by serving a specially crafted HTML page that triggers the out-of-bounds memory read when rendered by a vulnerable Chrome instance. Exploitation requires user interaction — specifically, the victim must visit the malicious page — but no authentication or elevated privileges are needed on the attacker's side. The Chromium issue tracker reference is bug #568937999 (Chrome Release).

Successful exploitation results in unauthorized memory disclosure from the Chrome browser process, potentially exposing sensitive in-memory data such as credentials, session tokens, or other browser-held content. The impact is limited to confidentiality (rated Low by CVSS), with no direct integrity or availability consequences. While the vulnerability does not enable arbitrary code execution on its own, memory disclosure primitives can serve as a stepping stone for more complex exploit chains targeting the browser (GitHub Advisory, Chrome Release).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is 0.0, indicating a very low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable as it requires user interaction (visiting a malicious page), which reduces its attractiveness for mass exploitation campaigns.

1. Reconnaissance: Identify targets running Google Chrome versions prior to 155.0.8059.84 on Windows, Mac, or Linux.
2. Craft malicious HTML page: Develop a specially crafted HTML page that triggers the memory corruption condition in Chrome's Core component, causing an out-of-bounds memory read.
3. Deliver the payload: Host the malicious HTML page on an attacker-controlled server and lure the victim into visiting it via phishing, malvertising, or a compromised website.
4. Trigger memory read: When the victim's vulnerable Chrome browser renders the page, the memory corruption flaw is triggered, causing the browser to read memory outside the intended buffer boundary.
5. Exfiltrate data: Capture the disclosed memory contents (e.g., via JavaScript or network callbacks embedded in the page) to extract sensitive in-memory data such as credentials or session tokens (Chrome Release, GitHub Advisory).

Google has released a patch in Chrome stable channel version 155.0.8059.84 (Linux) and 155.0.8059.84/.85 (Windows and Mac), which addresses this vulnerability along with nine other security fixes (Chrome Release). Users should update Chrome immediately via the browser's built-in update mechanism (Settings → Help → About Google Chrome). As a temporary workaround prior to patching, users should avoid visiting untrusted or suspicious websites. Enterprise administrators should prioritize deploying the update across managed endpoints.

The vulnerability was noted in automated vulnerability tracking feeds and aggregators shortly after disclosure, including VulDB, CIRCL, and ENISA's EUVD (Feedly). No significant independent researcher commentary or notable media coverage beyond standard vulnerability reporting has been observed for this specific CVE. The broader Chrome 155 security update, which also included a Critical-severity use-after-free (CVE-2026-110922), received more attention from the security community.