Google Chrome CVE-2026-106281

Exploitation requires the victim to load attacker-controlled web content that exercises Chrome's WebGPU pipeline so that the Tint shader compiler processes a crafted shader, triggering the use-after-free; this maps to the UI:R requirement in the CVSS vector. No authentication is required (PR:N) and the attack is fully remote over the network (AV:N/AC:L). The principal limiting factor is the mandatory user interaction (visiting the malicious page) and the need for the browser's WebGPU subsystem to be reachable; exploitation is bounded to Chrome versions prior to 155.0.8059.39, and updating to that stable release removes the exposure. Because the flaw enables escape 'outside the sandbox' (S:C), successful exploitation yields host-level impact rather than being confined to the renderer process.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated use-after-free (CWE-416) in Tint, the shader/WGSL compiler within Chrome's WebGPU/Dawn stack, that per the description can 'execute arbitrary code outside the sandbox' - the scope change (S:C) reflects exactly this renderer-to-host sandbox escape, which is the most severe class of browser bug. Signals are somewhat conflicting on urgency: CISA SSVC lists Exploitation as 'none' and there is no CISA KEV listing and no referenced POC, yet SSVC rates Technical Impact as 'total,' consistent with full code execution. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The one limiting factor is UI:R - a victim must visit attacker-controlled content - so this is driveby/social-engineering-dependent rather than wormable (SSVC Automatable: no). Net: because the affected product (Chrome) is effectively universal and a patched stable release exists, this warrants prompt patching even though no active exploitation is currently evidenced.

An attacker hosts or compromises a web page containing a crafted HTML/WebGPU payload that drives Tint to compile a malicious shader, triggering the use-after-free. When a victim running an unpatched Chrome (prior to 155.0.8059.39) browses to the page, the attacker corrupts memory to execute arbitrary code outside the renderer sandbox on the victim's machine. No public exploit was identified in the provided data, and successful exploitation requires the victim to visit the malicious page (UI:R).