CVE Intelligence
Analysis AI-assisted

CVE-2026-106281: Google Chrome Use-After-Free in Tint Component

A use-after-free flaw in the Tint component of Google Chrome could allow a remote attacker, using a crafted HTML page, to potentially execute arbitrary code outside the browser sandbox. The description states that Chrome versions prior to 155.0.8059.39 are affected, and the CVSS base score reported by the CNA and CISA-ADP is 9.6 (critical). No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-106281 is a use-after-free vulnerability (CWE-416) in the Tint component of Google Chrome. The record was published on 2026-10-06 by the Chrome CNA and is in Analyzed status in the sources consulted.

Impact

According to the description, a remote attacker could potentially execute arbitrary code outside the Chrome sandbox by convincing a user to open a crafted HTML page. The CVSS base score is 9.6 (critical) from both the CNA and CISA-ADP, and the SSVC technical impact is listed as total. The record also marks user interaction as required in the CVSS scoring.

Affected products and versions

  • Google Chrome versions before 155.0.8059.39 are described as affected.
  • The affected-range data in the record contains a second entry that describes a range from 155.0.8059.39 up to but not including 155.0.8059.39, which is internally contradictory. The version boundary should be read from the description and the vendor release notes.

Exploitation status

The CISA KEV catalog does not list this CVE, and the EPSS probability is 0.00338 (percentile 0.26045). The SSVC exploitation field is none and automatable is no. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Update Google Chrome to version 155.0.8059.39 or later, as indicated by the description and the vendor release notes linked below.
  • On managed systems, confirm that the browser update has been deployed across all endpoints, including systems where the browser is updated outside the normal channel.
  • Follow the vendor release notes for the specific fixed build for each platform: Chrome Stable Channel Update.

Detection guidance

  • Maintain an inventory of Chrome versions across the environment and flag any installation below 155.0.8059.39.
  • Review browser crash reports and unexpected browser child-process behavior on endpoints as a high-level indicator, recognizing that this is not a specific signature for this issue.

Limitations of the available information

  • The record does not include a fixed-version field, and the fixes list is empty. The absence of that field does not mean no fix exists; the description and release notes point to 155.0.8059.39.
  • The record does not include proof-of-concept details, and this analysis does not provide any.
  • The title field was empty in the record, so the title here is derived from the description.
  • The source for the reported CVSS scores is listed as a vendor identifier, and the full scoring rationale is not available.

Frequently asked questions

Which Chrome version fixes CVE-2026-106281?

The description states that Chrome versions prior to 155.0.8059.39 are affected, so updating to 155.0.8059.39 or later addresses the issue according to the sources. The record has no formal fixed-version field, so check the vendor release notes for platform-specific builds.

Is CVE-2026-106281 known to be exploited in the wild?

The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00338.

What is the severity of CVE-2026-106281?

The CVSS base score reported by the CNA and CISA-ADP is 9.6, which the record classifies as critical. The description also notes a Chromium security severity of High.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.