CVE-2026-106346: Improper state validation in Google Chrome

This vulnerability is due to improper state validation in the DevTools component of Google Chrome before version 155.0.8059.39. An attacker can exploit this flaw by crafting a malicious HTML page that, when loaded, may lead to arbitrary code execution inside the browser's sandbox environment. The issue was assigned a CVSS v3.1 score of 8.8, reflecting its high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and full impact on confidentiality, integrity, and availability. Google has addressed this vulnerability in the stable channel update released on October 6, 2026.

Successful exploitation allows remote attackers to execute arbitrary code within the sandboxed environment of Chrome's DevTools, potentially compromising the confidentiality, integrity, and availability of the affected system. This could lead to unauthorized actions or data exposure within the sandbox context. However, exploitation requires user interaction (loading a crafted HTML page). No known active exploits have been reported.

An official fix is available in Google Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.