Google Chrome CVE-2026-106298

Exploitation requires a macOS user running Google Chrome prior to 155.0.8059.39 to load attacker-controlled web content - the 'crafted HTML page' named in the description is the concrete trigger, exercising the use-after-free in the Chrome Tabs component. The chief limiting factor is required user interaction (CVSS UI:R): the victim must navigate to or open the malicious page; there is no zero-click vector indicated. No authentication is required (PR:N), and no non-default configuration is needed - default Chrome on affected macOS builds is vulnerable. Exploitation is platform-scoped to Mac per the advisory; achieving reliable code execution outside the sandbox additionally depends on successful heap grooming of the freed object.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, score 9.6) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction (UI:R), and the scope change (S:C) reflects that a successful attack escapes the Chrome renderer sandbox - the most impactful class of browser bug. The use-after-free (CWE-416) combined with the vendor-stated 'potentially execute arbitrary code outside the sandbox' means full host compromise is plausible. However, several exploitation signals are MISSING from the input: there is no EPSS probability, no CISA KEV listing, and no POC indicator provided, so exploitation status is 'no public exploit identified at time of analysis.' That absence should not be read as low risk - browser sandbox-escape UAFs are historically weaponized quickly, but as of this analysis there is no evidence of active exploitation. The primary limiting factor versus a 'drive-by with zero interaction' worst case is UI:R: a victim must open a crafted HTML page. Net: patch urgently given the impact and trivial attack complexity, while treating 'active exploitation' as unconfirmed rather than assumed.

An attacker hosts a malicious HTML page (or injects crafted markup into a compromised/advertising-served page) that triggers the use-after-free in Chrome's Tabs component when a macOS user visits it. By grooming the heap around the freed object, the attacker achieves memory corruption that leads to arbitrary code execution outside the renderer sandbox. No public proof-of-concept is indicated in the provided data, and exploitation requires the victim to load the page (UI:R).