CVE Intelligence
Analysis AI-assisted

CVE-2026-106211: Google Chrome TabStrip Use-After-Free

CVE-2026-106211 is a use-after-free flaw in the TabStrip component of Google Chrome, classified as CWE-416, with a CVSS score of 9.6. The record describes possible arbitrary code execution outside the sandbox through a crafted HTML page combined with social engineering. The CVE is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-106211 describes a use-after-free weakness in the TabStrip component of Google Chrome. According to the record, the flaw can be triggered through a crafted HTML page when a user is socially engineered into visiting it.

Impact

  • The record states that exploitation could potentially allow arbitrary code execution outside the browser sandbox.
  • The CVSS score is 9.6 (critical), with high confidentiality, integrity and availability impact and user interaction required.
  • The weakness is classified as CWE-416 (Use After Free).

Affected products and versions

  • Google Chrome versions before 155.0.8059.39 are described as affected.
  • The affected-range data contains a second entry with an empty range (from 155.0.8059.39 up to but not including 155.0.8059.39). It does not define a usable range and should be treated as a data inconsistency.
  • No fixed-version field is populated. The description implies that 155.0.8059.39 is the first unaffected version.

Exploitation status

  • The CISA KEV catalog does not list this CVE, so active exploitation is not confirmed by that source.
  • The SSVC record shows exploitation as none and automatable as no.
  • The EPSS probability is 0.00462 (percentile 0.39113) as of 2026-10-23.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Update Google Chrome to version 155.0.8059.39 or later, using the vendor's stable channel update.
  • Verify installed versions on managed endpoints and confirm that automatic updates are functioning.
  • Until patching is complete, reinforce user awareness about links and pages from unknown sources, and restrict browser use on sensitive systems where practical.

Detection guidance

  • Inventory Chrome versions across the environment and flag any installation below 155.0.8059.39.
  • Correlate browser crashes and unexpected browser-spawned processes with endpoint telemetry as a high-level signal to investigate.

Limitations of the available information

  • The record provides only a brief description. No technical details of the bug or public proof-of-concept are included.
  • The Chromium issue tracker entry requires permissions, so its details could not be reviewed.
  • The fixed-version field is empty and the affected-range data contains an inconsistent entry.

Frequently asked questions

What is CVE-2026-106211?

It is a use-after-free vulnerability in the TabStrip component of Google Chrome, according to the record. The description says it could be triggered through a crafted HTML page combined with social engineering.

Which versions are affected and what should be done?

The description states that Chrome versions before 155.0.8059.39 are affected. Updating to 155.0.8059.39 or later is the remediation path indicated by the record.

Is this CVE being actively exploited?

The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.