CVE-2026-106257: Use after free in Google Chrome

CVE-2026-106257 is a use-after-free vulnerability in the HTML handling of Google Chrome. It affects versions prior to 155.0.8059.39 and allows a remote attacker to execute arbitrary code inside the sandbox by delivering a specially crafted HTML page. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability. The vendor has released an official fix in version 155.0.8059.39.

Successful exploitation allows remote code execution within the sandbox environment of Google Chrome, potentially compromising confidentiality, integrity, and availability of the affected system. The attack requires user interaction but no privileges or authentication, making it a significant risk for end users running vulnerable versions.

An official fix is available in Google Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html for update instructions and confirmation of the fix.