Google Chrome CVE-2026-106227

Exploitation requires the victim to open attacker-controlled web content in a vulnerable Chrome build (prior to 155.0.8059.39) - the required user interaction (UI:R) means a user must navigate to or render a crafted HTML page, which is the primary limiting factor. No authentication or prior privileges are needed (PR:N), and it works against default Chrome configurations since the flaw is in the Core component rather than a non-default feature. The practical limiter is delivery: the attacker must drive the target to the malicious page via phishing, malvertising, or a compromised/embedded resource; there is no mass-automatable, interactionless vector (SSVC Automatable: no).

This is a genuine high-priority vulnerability despite the absence of exploitation signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes a network-reachable, low-complexity, unauthenticated use-after-free (CWE-416) that escapes the Chrome renderer sandbox - the scope change (S:C) and 'outside the sandbox' wording in the description are consistent and mutually corroborating, indicating full compromise of the underlying host, not just the browser tab. The CISA SSVC framework aligns on consequence (Technical Impact: total) but tempers urgency: Exploitation is rated 'none' and Automatable 'no', the latter because exploitation requires luring a victim to a crafted page (UI:R) rather than mass, unattended propagation. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or opportunistic exploitation at this time - the risk is driven by impact severity and the enormous install base, not by observed attacks. The one point to verify: SSVC Exploitation 'none' is a point-in-time judgment, and browser sandbox-escape UAFs historically attract exploit development quickly, so the low exploitation signal should not be read as durable. Patch availability from Google makes remediation straightforward, which further argues for prompt action.

An attacker hosts a malicious web page (or injects malicious content via a compromised ad/iframe) that triggers the use-after-free in Chrome's Core component when a victim running a version prior to 155.0.8059.39 visits it. Successful exploitation corrupts memory to achieve code execution that escapes the renderer sandbox, running attacker code on the victim's host with the user's privileges. No public exploit was identified at time of analysis, so exploitation currently presumes attacker-developed code.