External risk intelligence

Google Chrome Use After Free in FileSystem Component

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-110142

This vulnerability affects a client-side web browser. While it requires a remote attacker to provide a crafted HTML page, the attack surface is the client application itself, not a public-facing server, edge service, or internet-accessible appliance. It is not designed to be a public-facing service and typically operates behind user interaction within a local desktop environment.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Google Chrome's FileSystem component could allow a remote attacker to execute code outside the browser's security sandbox through a malicious webpage. While the severity is noted as Critical, its impact is primarily on client-side applications, suggesting the main concern is to confirm relevance and exposure within the organization.

Browser vulnerability allows code execution.
Affects user-facing desktop applications.
Confirm if Chrome is used by your staff.

Attack Path

How an attacker could exploit the issue

A remote attacker could exploit this vulnerability by luring a user to a malicious website. The attacker's crafted page would then trigger a use-after-free flaw within Chrome's file system handling. If successful, this could allow the attacker to execute arbitrary code on the user's system, potentially escaping the browser's sandbox.

Attacker provides malicious webpage.
Vulnerable file system component triggered.
Arbitrary code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in Chrome's FileSystem could allow a remote attacker to execute arbitrary code outside the browser's sandbox by tricking a user into visiting a malicious HTML page. This could potentially impact the confidentiality, integrity, and availability of the user's system.

User system and data.
Via a malicious HTML page.
Arbitrary code execution outside sandbox.

Operational Fix

Recommended remediation, mitigation, and detection steps

This "use after free" vulnerability in Google Chrome's FileSystem component requires a user to visit a malicious HTML page, presenting a lower immediate risk to external infrastructure. However, successful exploitation could allow arbitrary code execution outside the browser's sandbox, posing a significant risk to the endpoint. The first step is to identify all endpoints running the affected Chrome version and confirm their business criticality, then engage the relevant ownership for remediation planning.

Endpoint owners should address this issue.
Verify Chrome versions and user exposure.
Plan updates during scheduled maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the FileSystem component in Google Chrome?

Google Chrome uses the FileSystem component to allow web applications to store and manage local files securely. It provides a structured way for sites to save data, such as documents or offline resources, directly on your machine. This component acts as a bridge between the browser's sandbox and your computer's storage, ensuring that web-based activities can handle files while maintaining necessary security boundaries.

What does the use-after-free weakness mean in CVE-2026-110142?

This vulnerability, classified as CWE-416, happens when the browser fails to clear a reference to computer memory after that memory has been freed. If a program tries to use that memory again later, it can cause unpredictable behavior. In this CVE, an attacker can manipulate this state to bypass security protections and run unauthorized code on your computer, effectively tricking the browser into mismanaging its own internal memory.

How does an attacker trigger this Google Chrome vulnerability?

An attacker triggers this flaw by creating a specially crafted HTML page designed to interact with the FileSystem component. The vulnerability is not triggered by simply having the browser installed or running in the background. It specifically requires a user to navigate to that malicious webpage within the browser, which then exploits the memory management error.

Is my organization at risk from this CVE?

According to Halo Surface Signal, this vulnerability is very unlikely to affect your internet-facing infrastructure because it is a client-side browser issue. The risk resides on individual employee workstations rather than your public servers. You should prioritize this if your staff uses Google Chrome on company devices, as the threat is centered on the local desktop environment where users browse the web.

What should I do to address CVE-2026-110142?

Your first step is to perform an inventory of your endpoints to identify which systems are running an affected version of Google Chrome. Once identified, coordinate with the teams responsible for those devices to plan and apply the necessary browser updates during your next maintenance cycle. Focus on confirming which users have the software installed and ensuring they are prepared to move to a patched version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.