CVE-2026-110144 is a High severity (CVSS 8.6) incorrect authorization flaw in Mojo in Google Chrome on Windows before 155.0.8059.79. A local program could potentially run code outside the browser sandbox. Update Chrome on Windows to 155.0.8059.79 or later, then restart the browser so the update fully takes effect on every window and profile.
What's affected
The record says Chrome on Windows prior to 155.0.8059.79 is affected. The Chrome Releases post for the Stable channel dated 13 October 2026 says the channel moved to 155.0.8059.79 and .80 for Windows and Mac, and 155.0.8059.79 for Linux, rolling out over the coming days and weeks. It lists this CVE as High, with the description Incorrect authorization in Mojo, reported by Souma Ohsawa.
The weakness is CWE-863, incorrect authorization. The record rates it CVSS 8.6, with a local attack vector and a changed scope, which reflects the sandbox boundary. The Chromium bug is restricted, and the release post says access to bug details may stay restricted until most users are updated, so we do not have more technical detail.
The record lists Google Chrome and Microsoft Windows as the products. The release post bundles 37 security fixes in this build, so updating covers more than this one issue.
How to check if you're exposed
Open the About page in Chrome. Type the address below into the address bar.
chrome://settings/help
If the version is lower than 155.0.8059.79 on Windows, you are in range. Chrome starts the update check when the page opens, and it needs a restart to finish. Browsers that stay open for weeks are a common reason for late updates.
For fleets, query the installed version through your endpoint management tool, or read it from the registry on Windows. Other Chromium based browsers take the fix on their own schedule, so check each vendor's release notes. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Update Chrome to 155.0.8059.79 or later on Windows, and restart the browser.
- Check that managed devices are on the new version and find machines that have not restarted Chrome since the update arrived.
- Check Edge, Brave and other Chromium based browsers and Electron applications for their own updates.
- Keep automatic updates on, and shorten the allowed delay for pending restarts in managed environments.
- Reduce local code execution risk by limiting what users can install, since the attack described needs a local program.
Why it matters
Chrome relies on a sandbox so that a compromised renderer cannot touch the rest of the system. Mojo is the message passing layer between sandboxed and privileged processes, so an authorization mistake there is exactly the kind of bug that can weaken that wall.
The record's attack vector is local, which limits who can try this. It still matters, because sandbox escapes are often chained with a separate bug that gets code running inside the browser. The record does not mark the issue as known exploited, and the release post does not say it is. Patching is simple, since Chrome updates itself once it restarts.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Chrome version fixes CVE-2026-110144?
The record says versions prior to 155.0.8059.79 on Windows are affected. The 13 October 2026 Stable channel release carries that version.
Do I need to restart Chrome?
Yes. The update is downloaded in the background, but it takes effect only after Chrome restarts.
Sources
Last reviewed: 18 October 2026.
