CVE-2026-106227: Google Chrome Core Use-After-Free (CWE-416)
A use-after-free flaw in the Core component of Google Chrome, classified as CWE-416, is described as allowing a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. The description states that versions prior to 155.0.8059.39 are affected, and the CVSS base score in the record is 9.6. The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted.
Overview
This record describes a use-after-free flaw (CWE-416) in the Core component of Google Chrome. According to the description, the flaw can be triggered through a crafted HTML page and allows a remote attacker to execute arbitrary code outside the sandbox. The Chromium security severity is rated High. The vendor release note is listed among the references.
Impact
- The description states that a remote attacker could execute arbitrary code outside the sandbox.
- The CVSS base score of 9.6 is provided by the CNA and by CISA-ADP, both with the same value. The record's vector indicates network attack vector, low complexity, user interaction required, scope changed, and high impact on confidentiality, integrity and availability.
- The SSVC fields in the record indicate total technical impact, exploitation status none and automatable no.
Affected products and versions
- The description identifies Google Chrome versions prior to 155.0.8059.39 as affected.
- The record lists two affected ranges. The second range is internally inconsistent (from 155.0.8059.39 and before 155.0.8059.39), so it should be verified against the vendor release notes.
- No separate fixed-version field is populated in the record. The vendor release note is the primary reference to confirm the fix.
Exploitation status
The CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation in the wild appears in the sources consulted. EPSS reports a probability of 0.00423 with a percentile of 0.35603, dated 2026-10-23. SSVC marks exploitation as none and automatable as no.
Remediation and mitigation
- Update Google Chrome to 155.0.8059.39 or later, using the browser's built-in update mechanism or the stable channel release described by the vendor.
- In managed environments, confirm that all installations have received the stable channel update and verify version inventory across endpoints.
- Review the vendor release note and the Chromium issue tracker entry for details of the correction.
Detection guidance
- Inventory Chrome installations and record their version strings to identify hosts running versions prior to 155.0.8059.39.
- Monitor endpoints for unexpected browser behaviour at a general level. The sources consulted do not provide specific indicators of compromise.
Limitations of the available information
- The record title field is empty, so the titles were written from the CWE and product fields.
- No separate fixed-version field or patch identifier is present beyond the vendor release note.
- The affected ranges contain an inconsistency, as noted above.
- Only the CNA and CISA-ADP CVSS scores are present, and they match.
- The references supplied do not include technical root-cause details, and this analysis does not describe exploitation steps.
Frequently asked questions
Is this vulnerability being actively exploited?
The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted.
Which Chrome versions are affected?
The description identifies versions prior to 155.0.8059.39 as affected. Verify the affected range against the vendor release note because the record's second range is inconsistent.
What should administrators do?
Update Google Chrome to 155.0.8059.39 or later and confirm that managed installations have received the stable channel update.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.