Google Chrome CVE-2026-106190

Exploitation requires the victim to use an unpatched Google Chrome build prior to 155.0.8059.39 and to actively load attacker-controlled content - the CVSS UI:R and the description's 'crafted HTML page' confirm user interaction (visiting a malicious or compromised page) is mandatory; there is no server-side or passive network vector. No authentication is required (PR:N). A critical limiting factor is that code execution is confined to the renderer sandbox (S:U, 'inside the sandbox'), so achieving host-level compromise requires chaining a separate sandbox-escape vulnerability. No special non-default Chrome configuration is indicated - the Media component is part of the standard browser.

This is a genuinely high-priority patching item, though not an emergency at the time of analysis. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity flaw requiring no privileges but requiring user interaction - consistent with a browser victim visiting a malicious page. CWE-416 (use-after-free) in Chrome's Media component is a classic, highly weaponizable memory-corruption class. However, the signals are consistent in pointing to NO confirmed active exploitation: this CVE is not stated as CISA KEV, and the CISA SSVC decision framework explicitly records Exploitation: none and Automatable: no, which argues against widespread opportunistic mass-exploitation. SSVC Technical Impact: total aligns with the C:H/I:H/A:H impact. A critical nuance: the description states code execution occurs 'inside the sandbox' and CVSS scope is Unchanged (S:U), so a successful exploit yields renderer-process compromise that still requires a separate sandbox-escape to achieve full host takeover - the 8.8 score reflects in-sandbox impact, not host-level RCE. No EPSS score was provided, so exploitation probability cannot be quantified. Net: prioritize patching due to ubiquitous deployment and a trivially reachable attack surface, but there is no evidence of current in-the-wild use.

An attacker hosts or compromises a web page containing crafted media content and lures a Chrome user to visit it (e.g., via phishing link or malvertising). When Chrome processes the media, the use-after-free is triggered in the renderer, allowing the attacker to execute arbitrary code within the browser sandbox. No public exploit code has been identified at time of analysis, and full host compromise would additionally require a sandbox escape.