{"id":"CVE-2026-110916","published":"2026-10-15T22:19:26.943","lastModified":"2026-10-16T19:17:03.873","description":"Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-20"],"vendors":[],"products":[],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","tags":[]},{"url":"https://issues.chromium.org/issues/501886301","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Chrome's Desktop version had a vulnerability in input validation that could allow remote attackers to execute arbitrary code outside the sandbox through malicious HTML pages. This represents a critical security flaw because it enables full system compromise without user interaction.","exploitability":"Exploitation requires a remote attacker to host a malicious HTML page that triggers the validation flaw, with users needing to visit the page in Chrome Desktop for successful execution.","blast_radius":"The impact could be widespread as Chrome Desktop is commonly used for web browsing, potentially affecting millions of users who might encounter malicious pages in emails, websites, or social media.","remediation":"Upgrade to Chrome Desktop version 155.0.8059.84 or later","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","browser","sandbox-escape"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:47:48.003Z"}}