Google Chrome CVE-2026-106248

Exploitation requires the victim to open a maliciously crafted HTML page in Chrome prior to 155.0.8059.39, triggering a use-after-free in the Bindings component - this user interaction (UI:R) is the primary limiting factor. No authentication or prior privileges are needed (PR:N) and no non-default configuration is required; any default Chrome install below the fixed version is affected. A key mitigating limit is scope: successful exploitation yields code execution confined to the renderer sandbox (S:U), so full host compromise would additionally require a separate sandbox-escape vulnerability. Chrome's automatic update mechanism further narrows the realistic exposure window.

This is a genuine high-priority patch item but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity, unauthenticated exploitation requiring only that a victim visit a crafted page - the classic drive-by browser profile. However, the description explicitly scopes code execution to 'inside the sandbox' (consistent with S:U, no scope change), meaning a second sandbox-escape bug would be needed for full host compromise; on its own this does not yield OS-level control. Signals are mildly conflicting on urgency: CISA SSVC reports Exploitation: none and Automatable: no, while Technical Impact: total reflects the memory-corruption-to-RCE potential. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no evidence of active exploitation or public exploit code - the risk is driven by severity and ubiquity rather than demonstrated in-the-wild use. Given Chrome's auto-update footprint, the practical priority is ensuring the update to 155.0.8059.39 rolls out promptly rather than treating this as a live incident.

An attacker hosts or compromises a web page containing crafted HTML/JavaScript that triggers the use-after-free in Chrome's Bindings and lures or redirects a victim to visit it. Because attack complexity is low and no authentication is required, simply rendering the page can corrupt memory and execute attacker-controlled code within the renderer sandbox. No public exploit code was identified at time of analysis, and the achieved execution is confined to the sandbox absent a separate escape.