Update Chrome: Google fixes 37 security flaws, including seven critical bugs
Google patched 37 Chrome flaws, including seven critical bugs that can enable remote code execution.
78
CVE-2026-110147
Use-after-free in Google Chrome PDF handling
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-110147 is a use-after-free (CWE-416) in the PDF component of Google Chrome. A remote attacker can trigger it by convincing a user to open a crafted HTML page, and successful exploitation can run arbitrary code inside Chrome's sandbox. The issue is rated High by Chromium and has a CVSS 3.1 score of 8.8 (network, low complexity, user interaction required, high impact on confidentiality, integrity, and availability, scope unchanged). All Chrome versions before 155.0.8059.79 are affected. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Update Google Chrome to version 155.0.8059.79 or later on all desktops and managed devices, and confirm the running version in chrome://settings/help. Until rollout is complete, avoid opening untrusted HTML pages that load or embed PDF content.
| Product | Affected |
|---|---|
| Google Chrome | prior to 155.0.8059.79 |
Estimated exposure
masson the order of billions of Chrome users worldwide; unpatched installs plausibly still in the hundreds of millions during rollout — Google Chrome is the dominant desktop and mobile browser, with public market-share and Google usage figures on the order of billions of users; any install still below 155.0.8059.79 is affected until the stable update is applied.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)