CVE-2026-110165 explained: the Google Chrome flaw and how to fix it

The two-minute check

1. Open Chrome on the device in question.
2. Click the three-dot menu in the top right corner.
3. Select Help, then About Google Chrome.
4. Look at the version number shown on that screen.
5. Compare it to 155.0.8059.79. If your number is lower, this applies to you until it updates.

When you can stop reading

If your business does not use Google Chrome anywhere, on any computer, phone, or server, this flaw does not apply to you. If every device you checked already shows 155.0.8059.79 or higher, you can close this tab. The record covers Chrome on Android, Windows, and macOS, so check any device running those systems too.

What the official record says

The National Vulnerability Database (NVD) scores CVE-2026-110165 at 9.6, rated CRITICAL. The vector shows an attacker needs no password and no physical access to your device. The scope is marked "changed," which means the flaw can let code break out of Chrome's safety sandbox. Someone would still need to get you to open a crafted web page first, since the vector requires user interaction.

The Exploit Prediction Scoring System (EPSS) puts this at 0.21% probability, percentile 10.336, a low chance of exploitation in the next 30 days (FIRST.org). EPSS only forecasts exploitation activity over the next 30 days. It is not a measure of how severe the flaw itself is.

This flaw is not on the Known Exploited Vulnerabilities (KEV) catalog. The record shows no confirmed exploitation so far, and that status can change.

The same Chrome update also fixes 35 other issues found during the same security review. Google groups them together under one release, so installing the update resolves all of them at once. The related ids are listed here for your records:

• CVE-2026-110161, CVE-2026-110159, CVE-2026-110152, CVE-2026-110149, CVE-2026-110142, CVE-2026-110136, CVE-2026-110172
• CVE-2026-110171, CVE-2026-110169, CVE-2026-110168, CVE-2026-110167, CVE-2026-110166, CVE-2026-110164, CVE-2026-110163
• CVE-2026-110162, CVE-2026-110157, CVE-2026-110155, CVE-2026-110154, CVE-2026-110153, CVE-2026-110151, CVE-2026-110148
• CVE-2026-110147, CVE-2026-110140, CVE-2026-110139, CVE-2026-110137, CVE-2026-110144, CVE-2026-110158, CVE-2026-110156
• CVE-2026-110145, CVE-2026-110138, CVE-2026-110146, CVE-2026-110170, CVE-2026-110143, CVE-2026-110160, CVE-2026-110141

What that means for a business like yours

A critical score paired with a sandbox escape means a malicious web page could potentially run its own code outside Chrome's protections. In practice, that could let an attacker reach further into the device after someone simply opens a bad link. The low EPSS forecast suggests this is not being used widely today. Patches like this one exist to close that door before it changes.

If someone else manages your IT

If a provider like LayerLogix's managed IT services handles your updates, send them this note:

"Please confirm Google Chrome is updated to 155.0.8059.79 or later on all our devices. This patches CVE-2026-110165 and the related bugs fixed in the same release. Please confirm when this is done."

If you manage it yourself

1. Open Chrome on each computer or phone your business uses.
2. Click the three-dot menu in the top right corner.
3. Select Help, then About Google Chrome.
4. Let Chrome finish checking for and downloading the update on its own.
5. Click Relaunch when it appears, to apply the update.
6. Repeat this check on every device, including phones running Android.

The record shows no confirmed exploitation of this flaw yet, and that status can change without notice. Given the critical score, a reasonable window is to update within the next few business days. If exploitation is later confirmed, that window should shrink to the same day. There is no need to treat this as an emergency right now, just a priority.

Open Chrome again and check the About screen once more. The version should now read 155.0.8059.79 or higher. If Chrome prompted you to relaunch earlier, click it now. The update does not take effect until the browser actually restarts.

If you can't update immediately, avoid opening unfamiliar links or attachments in Chrome until you do. This lowers the chance of hitting the kind of crafted page this flaw needs, but it does not remove the risk. Running endpoint detection and response (EDR) software can flag suspicious behavior after a bad page runs, though it will not stop the flaw itself. Limiting administrator rights through privileged access management reduces what an attacker can do if they succeed. None of these steps replace installing the update. They only buy you time until you can.

Do I have to do anything if we only use this at home?

Yes. The fix applies to Chrome on any device, including personal computers and phones. If you use Chrome for anything, update it the same way described above.

Will updating break anything?

Chrome updates like this one are routine and usually do not change your saved logins, bookmarks, or extensions. A short restart is the only disruption most people notice.

Does this affect the operating system on our computers, or just the browser?

The flaw is in Google Chrome itself, not in Windows or macOS as operating systems. If you run Chrome on a Windows, macOS, or Android device, the fix still applies to the browser running there.

How do we know if an attacker has already used this against us?

The record shows no confirmed exploitation of this flaw. There is no specific sign to look for beyond unusual activity on a device. If you are concerned, a cybersecurity review can check for signs of compromise.

What if we have many devices to update?

Chrome usually updates itself in the background on each device. For a business with several devices, a managed IT service can confirm every one is current. You can also request a free IT assessment to check your whole device fleet.

If you want help confirming every device in your business is patched, contact LayerLogix. LayerLogix brings 20+ years of experience and 100% Texas-based support to businesses across The Woodlands, Round Rock, Houston, Dallas-Fort Worth, and Austin.