CVE-2026-106424: Information leak in Google Chrome

CVE-2026-106424 is an information leak vulnerability in the Audio subsystem of Google Chrome versions before 155.0.8059.39. A remote attacker with control over the renderer process can exploit this flaw via a crafted Chrome extension to read memory outside the sandbox, potentially exposing sensitive information. The vulnerability is acknowledged by Google and classified with medium severity. The vendor advisory linked indicates a stable channel update addressing this issue.

The vulnerability allows an attacker who has already compromised the renderer process to bypass sandbox memory protections and read memory outside the intended boundaries. This could lead to exposure of sensitive information from the browser's memory space. However, exploitation requires prior compromise of the renderer process and use of a crafted extension, limiting the attack vector.

Google has released an official fix in Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.