Google Chrome CVE-2026-106200

Exploitation requires the victim to actively load an attacker-controlled crafted HTML page in a vulnerable Chrome build (any version prior to 155.0.8059.39), consistent with UI:R in the CVSS vector - this user-interaction requirement is the primary limiting factor and prevents silent, zero-click or automatable mass exploitation (reflected in SSVC Automatable=no). No authentication or special victim configuration is needed (PR:N), and the affected Track code path is reachable in default Chrome configurations. The key impact limiter is that resulting code execution is confined to Chrome's renderer sandbox; escaping to the host OS would require chaining an additional, separate sandbox-escape vulnerability not covered by this CVE.

CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a network-reachable, low-complexity, unauthenticated bug that requires user interaction (victim must visit a crafted HTML page) and yields high confidentiality, integrity, and availability impact within an unchanged scope. The SSVC decision framework tempers this: Exploitation=none (no observed or public exploitation), Automatable=no (requires luring a victim to a page, so not mass-scannable/wormable), and Technical Impact=total (consistent with the C:H/I:H/A:H and CWE-416 use-after-free code-execution potential). A critical limiting nuance the vendor states explicitly is that code execution occurs 'inside the sandbox' - Chrome's renderer sandbox normally contains such a renderer-process compromise, so a full host takeover would require chaining this with a separate sandbox-escape, which is NOT part of this CVE. No KEV listing and no EPSS score were provided in the input, and no public exploit is referenced; therefore real-world risk is currently moderate-to-high rather than emergency: the technical impact is severe but exploitation is non-automatable, unobserved, and sandbox-confined. Treat as a standard high-priority browser patch rather than an actively-exploited zero-day. EPSS data is absent and cannot be used to gauge exploitation probability - verify against live EPSS/KEV feeds before final prioritization.

An attacker hosts or compromises a web page containing specially crafted HTML/media markup and lures a victim into visiting it (e.g., via phishing link or malvertising). When the victim's Chrome (before 155.0.8059.39) renders the page, the Track use-after-free is triggered, giving the attacker arbitrary code execution within the renderer sandbox. No public exploit code is referenced in the input, and SSVC reports no observed exploitation.