Update Chrome: Google fixes 37 security flaws, including seven critical bugs
Google patched 37 Chrome flaws, including seven critical bugs that can enable remote code execution.
78
Vulnerability3 · 2 reads
CVE-2026-110136
Use-after-free in Chrome PDF enables sandbox escape
- CVSS 3.1
- 9.6 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A use-after-free flaw in Google Chrome’s PDF handling (CWE-416) lets a remote attacker run arbitrary code outside the browser sandbox. The issue is triggered when a user visits a crafted HTML page, so user interaction is required and no privileges are needed. Successful exploitation can fully compromise confidentiality, integrity, and availability of the host beyond Chrome’s sandbox, and Google rated it Critical (CVSS 3.1 base score 9.6). It affects Google Chrome versions prior to 155.0.8059.79. It is not listed in CISA’s Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Update Google Chrome to version 155.0.8059.79 or later on all desktops as soon as possible. Until the update is installed, avoid opening untrusted web pages, especially ones that load PDF content, and confirm that automatic updates are enabled and have completed.
| Product | Affected |
|---|---|
| Google Chrome | prior to 155.0.8059.79 |
Estimated exposure
masson the order of 1 billion+ Chrome users (dominant desktop browser; unpatched installs) — Google Chrome is the dominant desktop browser, with on the order of a billion or more users worldwide; any installation not yet updated to 155.0.8059.79 or later is in scope.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)