Google Chrome CVE-2026-106349

Exploitation requires a victim running Google Chrome prior to 155.0.8059.39 to visit an attacker-controlled web page containing crafted HTML/JavaScript that exercises the vulnerable V8 code path (UI:R - user interaction in the form of navigating to the page is required). No authentication, special privileges, or non-default configuration is needed; the V8 JavaScript engine is enabled by default in all standard Chrome installations. The primary limiting factor is that successful code execution is confined to the renderer sandbox per the vendor description, so a standalone exploit does not by itself achieve host/OS compromise - a separate sandbox-escape vulnerability would be required to break out. The need to lure the user to a malicious page also bounds opportunistic, fully automatable exploitation (consistent with SSVC 'Automatable: no').

This is a genuine priority-worthy issue, though several signals temper its urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a remote, low-complexity, unauthenticated attack requiring only that a victim load a crafted HTML page - a trivially achievable bar for a web browser. Technical impact is high across confidentiality, integrity and availability (C:H/I:H/A:H), consistent with SSVC's 'Technical Impact: total'. However, the signals are NOT all pointing to active mass exploitation: SSVC records 'Exploitation: none' and 'Automatable: no', the CVE is not listed in CISA KEV, no EPSS score was provided in the input, and no public proof-of-concept is referenced. The description also explicitly states code execution occurs 'inside the sandbox,' meaning this single bug yields renderer-process compromise rather than full host takeover absent a separate sandbox-escape chain - a material limiting factor the CVSS base score does not capture. Net: treat as a high-priority patch (browser, ubiquitous, trivial attack vector, vendor-confirmed High severity) but note that there is no evidence of in-the-wild exploitation at time of analysis, and EPSS is missing so probabilistic exploitation likelihood could not be weighed.

An attacker hosts or compromises a web page containing malicious JavaScript/HTML that triggers a use-after-free in Chrome's V8 engine; when a victim using a pre-155.0.8059.39 build visits the page, the freed object is reused to corrupt memory and execute attacker-controlled code within the renderer sandbox. No authentication is required and attack complexity is low, but the victim must be lured into visiting the page (UI:R), and the resulting code execution is confined to the sandbox unless chained with an escape. No public exploit code was identified at time of analysis.