Google Chrome CVE-2026-106315

Exploitation requires the victim to load attacker-controlled web content in a vulnerable Chrome build (prior to 155.0.8059.39) - the crafted HTML page is the trigger, satisfying the CVSS UI:R requirement, so this is a drive-by / user-interaction-dependent attack rather than a zero-click one. No authentication or special configuration is needed (PR:N), and default Chrome configurations are affected. The principal limiting factor is that arbitrary code execution is confined to the renderer sandbox: without a separate sandbox-escape vulnerability, the attacker cannot reach the host OS or other processes, which bounds realistic impact. Updating to 155.0.8059.39 or later fully remediates.

This is a genuinely serious but not yet urgent vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity flaw needing no privileges, only that a victim open a crafted HTML page - a trivially met condition for a web browser. However, CISA's SSVC framework reports Exploitation: none and Automatable: no, with Technical Impact: total, meaning no active exploitation is observed and the attack is not self-propagating despite full control of the affected component once triggered. No EPSS score and no KEV listing were provided, and no public exploit is identified, so all signals point to a high-potential but currently unexploited bug. Critically, the description states code execution occurs 'inside the sandbox' - Chrome's renderer sandbox contains the attacker, so this flaw alone does not yield host compromise without a separate sandbox-escape chain; this materially tempers the real-world severity below what the 8.8 score suggests in isolation. Google itself rated the Chromium security severity only 'Medium,' which is consistent with sandbox containment. Net: patch-priority due to ubiquity of Chrome and ease of the drive-by vector, but not an emergency absent evidence of exploitation or a paired escape.

An attacker hosts or compromises a web page containing specially crafted content that triggers the use-after-free in Chrome's Modularization component when rendered. A victim running a pre-155.0.8059.39 Chrome visits the page (UI:R), and the dangling-pointer reuse lets the attacker execute arbitrary code within the renderer sandbox. No public exploit is identified at time of analysis, and full host compromise would require chaining an additional sandbox escape.