CVE Intelligence
Analysis AI-assisted

CVE-2026-106197: Google Chrome Browser Use-After-Free Vulnerability

CVE-2026-106197 is a use-after-free flaw in the Browser component of Google Chrome before 155.0.8059.39. According to the record, a remote attacker could trigger it with a crafted HTML page to run arbitrary code outside the browser sandbox. The record assigns a CVSS 3.1 base score of 9.6, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-106197 is a use-after-free weakness (CWE-416) in the Browser component of Google Chrome. The record describes it as affecting versions before 155.0.8059.39 and as triggerable through a crafted HTML page. Chromium's own severity label for the issue is Critical. Vendor context is available in the Chrome Releases stable channel update and the Chromium issue tracker entry.

Impact

  • The record describes arbitrary code execution outside the browser sandbox by a remote attacker.
  • The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, indicating network reachability, low complexity, no privileges required, user interaction required, scope change, and high impact to confidentiality, integrity and availability. The record gives a base score of 9.6.
  • The SSVC fields in the record report exploitation as none and automatable as no.

Affected products and versions

  • Product: Google Chrome (Browser component).
  • Versions: before 155.0.8059.39, according to the description.
  • The affected-range data contains a second entry with a lower bound and upper bound both at 155.0.8059.39, which describes an empty range. It should not be read as a separate affected population. The endpoint to use for planning is 155.0.8059.39.

Exploitation status

  • The record lists the issue as not present in CISA KEV.
  • No confirmed exploitation in the wild appears in the sources consulted for this record.
  • The EPSS probability in the record is 0.00454, with a percentile of 0.38475.

Remediation and mitigation

  • Update Google Chrome to 155.0.8059.39 or later. The description implies this version is the first unaffected release, so confirm the installed build against the vendor release notes.
  • Prioritize updates on endpoints that routinely browse untrusted or external web content.
  • Keep automatic updates enabled and track the vendor release notes linked above.

Detection guidance

  • Inventory installed Chrome versions across the environment and flag any build older than 155.0.8059.39.
  • Use endpoint telemetry to review unusual behavior from browser processes as a supplementary signal, without relying on it as the main control.

Limitations of the available information

  • The record does not provide a fixed-version list beyond the endpoint stated in the description, and it does not include vendor technical details about the bug.
  • The fixes field in the record is empty. This does not mean that no fix exists.
  • Platform-specific build details for Windows, macOS and Linux are not given in the record.
  • The record's EPSS date is later than its publication date, so the EPSS figures should be treated as a snapshot.

Frequently asked questions

Is CVE-2026-106197 being actively exploited?

The record lists the issue as not present in CISA KEV, and no confirmed exploitation appears in the sources consulted for this record.

Which Chrome versions are affected?

According to the description, Google Chrome versions before 155.0.8059.39 are affected. Updating to 155.0.8059.39 or later is the recommended step.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.