CVE-2026-110143

Undergoing Analysis Undergoing Analysis - In Progress

Use of Uninitialized Variable in ThirdParty lmza_sdk in Google Chrome

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: Chrome

Description

Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted file. (Chromium security severity: High)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110143

EUVD

EUVD-2026-100635

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 155.0.8059.79 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-457	The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

Attack-Flow Graph

Executive Summary

This vulnerability involves the use of an uninitialized variable in the ThirdParty lmza_sdk component of Google Chrome before version 155.0.8059.79. An attacker could exploit this by crafting a specific file to potentially read memory within the sandbox environment.

Impact Analysis

An attacker could exploit this flaw to read sensitive memory inside the sandbox, potentially exposing confidential data or enabling further attacks. Users of affected Chrome versions are at risk if they process untrusted files.

Mitigation Strategies

Update Google Chrome to version 155.0.8059.79 or later to address the uninitialized variable issue in the lmza_sdk component.

Hi! I’m here to help you understand CVE-2026-110143. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70