CVE Intelligence
Analysis AI-assisted

CVE-2026-106234: Google Chrome Use-After-Free in Network Component

A use-after-free flaw in the Network component of Google Chrome, prior to 155.0.8059.39, could be triggered through social engineering with a crafted Chrome extension. The record reports potential arbitrary code execution outside the sandbox and a CVSS 3.1 score of 9.6, with no confirmed exploitation in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-106234 is a use-after-free vulnerability (CWE-416) in the Network component of Google Chrome. According to the record, a remote attacker who uses social engineering and a crafted Chrome extension could potentially execute arbitrary code outside the sandbox. The vendor's Chromium security severity label is Low, while the CVSS 3.1 base score assigned by the CNA and by CISA-ADP is 9.6.

Impact

  • The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, indicating network reachability, low complexity, no privileges required, user interaction required, changed scope, and high impact to confidentiality, integrity and availability.
  • The record's SSVC data lists technical impact as total, exploitation as none, and automatable as no.
  • Arbitrary code execution outside the sandbox is described as a potential outcome, not as a demonstrated one.

Affected products and versions

  • Product: Google Chrome.
  • The description identifies versions prior to 155.0.8059.39 as affected.
  • The affected-version data contains a second entry, from 155.0.8059.39 and before 155.0.8059.39, which is internally contradictory and cannot be applied as written. Confirm the affected range against the vendor release notes.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog, so no active exploitation is reported through KEV. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00312 (percentile 0.22907) as of 2026-10-23.

Remediation and mitigation

  • Update Google Chrome to 155.0.8059.39 or later, the release the description identifies as containing the fix.
  • Ensure the update is applied across managed endpoints, including browsers that update through a separate channel.
  • Restrict installation of unreviewed extensions through enterprise policy, since the attack path described depends on a crafted extension and social engineering.
  • Review the Chrome stable channel release notes for build-level details.

Detection guidance

  • Inventory installed Chrome builds and flag any earlier than the fixed release.
  • Review installed extensions for unfamiliar or recently added items, especially those installed after unsolicited messages or links.
  • Monitor for unexpected browser crashes as a general indicator of memory-safety issues; the sources do not provide specific detection signatures.

Limitations of the available information

  • The record has no populated fixed-version field; the fixed build is taken from the description text.
  • The record does not describe exploit conditions beyond the summary, and no public proof of concept is referenced.
  • The conflicting affected-version entries and the gap between the vendor severity label and the CVSS score are not resolved by the sources provided.
  • Whether additional fixed builds or backports exist is unknown from the available data.

Frequently asked questions

Is this vulnerability being actively exploited?

The record shows this CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. Active exploitation is therefore not reported.

What should administrators do?

Update Google Chrome to 155.0.8059.39 or later, and restrict installation of unreviewed extensions through enterprise policy.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.