CVE-2026-110149
CVSS: 9.6v3.1CriticalAnalyzed
AliasesDEBIAN-CVE-2026-110149
Published 2026-10-13Last modified 2026-10-14
Vulnerability summary
CVSS score
9.6/10
010
Critical · v3.1 (cve.org)EPSS score
0.21%
0%100%
Low · Change unavailableKEVNot listed0 of 3 catalogs
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 2026-10-13PublishedVulnerability first disclosed.
- 2026-10-14Last modifiedVulnerability information updated.
Description
Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVSS metrics
2 scores · 2 sources · 1 versionCritical 9.6Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HSourcesAll 2 agree
- NVDNIST9.6CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
2026-10-142026-10-14
EPSS score0.21%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- chromiumAll versions (No fix recorded)
Google1 product
- chrome≥ 155.0.8059.79, < 155.0.8059.79 | < 155.0.8059.79
2 vendors · 2 products
References
3 links- chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.htmlRelease NotesVendor Advisory
- issues.chromium.org/issues/568437149Permissions Required
