Google Chrome CVE-2026-106268

Exploitation requires the victim to load attacker-controlled content in Chrome (UI:R) - specifically a crafted HTML page that exercises the vulnerable WebRTC code path; no authentication or prior privileges are needed (PR:N). The practical LIMITS are: (1) required user interaction - the target must open or be redirected to the malicious page; (2) the affected version boundary - only Chrome builds prior to 155.0.8059.39 are vulnerable, and Chrome's auto-update rapidly shrinks this window; and (3) impact confinement - code execution is scoped to the renderer sandbox ('inside the sandbox'), so a separate sandbox-escape vulnerability is needed to reach the host OS. WebRTC is enabled by default in Chrome, so no special non-default configuration is required to reach the vulnerable surface.

This is a credible priority patch, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 HIGH) indicates a network-reachable, low-complexity, unauthenticated flaw that only requires the victim to load a crafted HTML page - a trivially satisfied bar for a browser. Use-after-free (CWE-416) in a browser renderer is a classic path to arbitrary code execution and Chromium itself rated the severity High. Tempering the raw score: the description explicitly scopes code execution to 'inside the sandbox' (S:U, no scope change), meaning this alone yields renderer-level compromise and would typically need to be chained with a separate sandbox-escape bug for full host takeover - a critical nuance for prioritization. No KEV listing and no public POC were provided, so there is no evidence of active exploitation; EPSS was not supplied and cannot be cited. No SSVC decision data was provided. The signals are internally consistent (no contradiction between the network vector and the crafted-page delivery model). Net: patch promptly given Chrome's ubiquity and the WebRTC attack surface, but treat as 'important' rather than 'actively exploited critical' absent exploitation telemetry.

A remote attacker hosts or compromises a web page containing malicious WebRTC-triggering content and lures a Chrome user (pre-155.0.8059.39) to visit it. Loading the page triggers the use-after-free in WebRTC, letting the attacker execute arbitrary code within the renderer sandbox. No public exploit code was identified at time of analysis; full host compromise would require chaining a separate sandbox escape.