CVE Intelligence
Analysis AI-assisted

CVE-2026-106375: Google Chrome Dawn Incomplete Cleanup Sandbox Escape Vulnerability

CVE-2026-106375 is an incomplete cleanup issue in the Dawn component of Google Chrome, as described in the record. The record says a remote attacker could potentially execute arbitrary code outside the sandbox through a crafted HTML page. The vendor release notes are the main source for the fixed version, 155.0.8059.39.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The Google Chrome stable channel release notes reference a fix for CVE-2026-106375, an incomplete cleanup issue in the Dawn component. According to the record, a remote attacker could potentially execute arbitrary code outside the sandbox by luring a user to a crafted HTML page.

Impact

  • The record describes potential arbitrary code execution outside the Chrome sandbox.
  • The CVSS 3.1 base score is 9.6 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, which reflects high confidentiality, integrity and availability impact and a scope change.
  • The Chromium security severity is listed as Medium. This is the vendor's own rating and is separate from the CVSS score.

Affected products and versions

  • Product: Google Chrome.
  • The record describes versions prior to 155.0.8059.39 as affected, and 155.0.8059.39 is the version the sources point to as the fix.
  • The affected-version data in the record contains two overlapping entries that both reference 155.0.8059.39. The exact boundary should be confirmed against the vendor release notes.

Exploitation status

  • The record does not mark this CVE as listed in the CISA KEV catalog. No confirmed active exploitation appears in the sources consulted.
  • The EPSS probability is 0.00402 with a percentile of 0.33327, dated 2026-10-23. The SSVC exploitation value in the record is none.

Remediation and mitigation

  • Update Google Chrome to version 155.0.8059.39 or later, as indicated by the vendor release notes.
  • Confirm that managed browsers are updating and verify the installed version across endpoints.
  • Keep browser sandbox and site isolation protections enabled, and treat unexpected browser behavior on untrusted pages as a priority to investigate.

Detection guidance

  • Inventory Chrome versions across the fleet and flag hosts running a version earlier than 155.0.8059.39.
  • Review endpoint telemetry for unexpected child-process activity originating from the browser. This is a general signal and not a validated indicator for this CVE.

Limitations of the available information

  • The sources do not describe the function of the Dawn component or the precise nature of the cleanup flaw.
  • The Chromium issue tracker link is tagged as requiring permissions, so the full technical details may not be publicly visible.
  • The record gives the CWE identifier CWE-459 but no CWE name.
  • The affected-version entries in the record overlap, so the exact range is not fully clear from the record alone.

Frequently asked questions

Is CVE-2026-106375 being actively exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted. EPSS and SSVC values in the record are low.

Which Chrome version fixes this issue?

The record and the vendor release notes point to 155.0.8059.39 as the fixed version. Users on earlier versions should update to that release or later.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.