Critical Chrome Prerender Flaw Lets Attackers Execute Code

Threat: Vulnerability

Targeted Region: Global

Targeted Sector: Technology & IT

Criticality: High

[subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

Multiple security vulnerabilities have been identified in Google Chrome, affecting desktop builds prior to version 155.0.8059.84 on Windows, Mac, and Linux. These flaws include critical use after free issues and high-severity memory corruption bugs, primarily within the V8 JavaScript engine, Prerender, and DOM components. The overall risk is significant, as successful exploitation could allow malicious web pages to execute arbitrary code or crash browser tabs, though no active exploitation has been confirmed.

CVE-2026-110922 (CVSS 8.8 — High): This use after free vulnerability exists in the Prerender component, which loads pages before user interaction. An attacker can exploit this by luring a victim to a crafted web page that triggers the memory error, potentially leading to code execution.[/subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

CVE-2026-110913 (CVSS 8.8 — High): This flaw involves improper restriction of operations within the bounds of a memory buffer in the DOM component. It allows for memory corruption that could be triggered by malicious content, posing a high risk to browser stability and security.

CVE-2026-110919 (CVSS 8.8 — High): A use after free vulnerability in the V8 JavaScript engine enables memory corruption. Attackers can exploit this by serving specially crafted JavaScript code to a victim, potentially resulting in arbitrary code execution within the browser process.

CVE-2026-110921 (CVSS 8.8 — High): This use after free issue is located in the V8 engine and allows for memory corruption. Similar to other V8 flaws, it can be triggered by malicious web content, granting an attacker the capability to compromise the browser's integrity.

CVE-2026-110920 (CVSS 8.8 — High): This vulnerability is a memory corruption flaw in the V8 engine caused by improper restriction of operations within memory buffer bounds. It can be exploited by a remote attacker through a malicious web page to execute unauthorized code.

CVE-2026-110915 (CVSS 8.8 — High): This use after free vulnerability is present in the V8 JavaScript engine. It allows for memory corruption that can be triggered by malicious input, potentially leading to code execution or denial of service.

CVE-2026-110914 (CVSS 8.8 — High): This flaw involves improper restriction of operations within the bounds of a memory buffer in the Core component. It results in memory corruption that can be exploited by a remote attacker to compromise the browser's security.

CVE-2026-110918 (CVSS 4.3 — Medium): This medium-severity vulnerability is a memory corruption issue in the SVG component due to improper restriction of operations within memory buffer bounds. While less critical than high-severity flaws, it still poses a risk of browser instability or compromise.

CVE-2026-110917: This vulnerability is associated with memory corruption in the Core component. It represents a security flaw that could be exploited to affect browser stability or security, though specific severity metrics are not provided in the available data.

These vulnerabilities collectively present a substantial risk to users of affected browser versions, particularly those who visit untrusted websites. The presence of multiple high-severity memory corruption flaws in core components like the JavaScript engine and rendering pipeline means that a single malicious page could potentially lead to full system compromise. Users should ensure their browsers are updated to the latest secure version to mitigate these risks.