Google Chrome CVE-2026-106318

Exploitation requires a user running a vulnerable Chrome build (prior to 155.0.8059.39) to actively load an attacker-controlled HTML page that exercises the vulnerable Media component - this user interaction (UI:R) is the primary limiting factor and prevents unattended, wormable exploitation. No authentication or special privileges are needed (PR:N) and no non-default configuration is required, so default Chrome installs are affected. The key impact limiter is that resulting code execution is confined to the renderer sandbox (S:U); a separate sandbox-escape vulnerability would be required to compromise the underlying host.

This is a genuine high-priority patching item, though the signals are mixed on urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity, unauthenticated code execution requiring only that a victim visit a crafted HTML page - a classic drive-by browser exploitation profile with high impact across confidentiality, integrity, and availability. SSVC counters the raw severity: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (victim interaction is required, so it cannot be mass-sprayed), and Technical Impact is 'total', consistent with a CWE-416 use-after-free leading to arbitrary code execution. Critically, the description states code execution is 'inside the sandbox' - meaning this flaw alone yields only renderer-level compromise and would need to be chained with a separate sandbox-escape bug for full host takeover; the CVSS Scope:Unchanged (S:U) is consistent with that containment. No EPSS score was provided, there is no CISA KEV listing, and no public POC is referenced, so exploitation probability signals are absent rather than conflicting. Net: real risk owing to Chrome's enormous footprint and the trivial delivery vector, but SSVC and the sandbox limitation argue this is important-to-patch rather than emergency-grade, barring a future KEV update.

An attacker hosts or compromises a web page containing crafted HTML/media content and lures a Chrome user to visit it (via phishing link, malvertising, or a watering-hole). When the browser's Media component parses the content, the use-after-free is triggered and the attacker achieves arbitrary code execution within the renderer sandbox. No public exploit code was identified at time of analysis; the low attack complexity (AC:L) makes reliable exploitation feasible for a skilled attacker, but user interaction (UI:R) is mandatory.