{"id":"CVE-2026-110137","published":"2026-10-13T22:17:33.447","lastModified":"2026-10-15T04:18:17.233","description":"Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-416"],"vendors":["google"],"products":["chrome"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/561997899","tags":["Permissions Required"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A use-after-free vulnerability in Chrome's WebRTC implementation allows remote attackers to execute arbitrary code within the sandboxed browser environment when visiting a malicious webpage. This represents a critical security flaw that can lead to complete browser compromise and potential system access.","exploitability":"Exploitation requires a remote attacker to craft a malicious HTML page that triggers the use-after-free condition, which is moderately difficult but achievable with modern exploitation techniques and typically requires user interaction through a web browser.","blast_radius":"If exploited, this vulnerability could affect millions of Chrome users who browse the web, potentially leading to full system compromise through sandbox escape and remote code execution in the context of the Chrome process.","remediation":"Upgrade to Google Chrome 155.0.8059.79 or later immediately","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","webrtc","browser","sandbox-escape"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:24:22.099Z"}}