Information leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory… (CVE-2026-106424)

CVE-2026-106424 is an information leak vulnerability in the audio subsystem of Google Chrome before version 155.0.8059.39. It enables a remote attacker, with control over the renderer process, to read memory outside the sandbox environment via a specially crafted Chrome extension. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). The CVSS v3.1 base score is 4.0, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and partial confidentiality impact.

An attacker who has compromised the renderer process can exploit this vulnerability to read sensitive memory contents outside the sandbox, potentially exposing confidential information. The impact is limited to confidentiality with no integrity or availability effects. The medium severity indicates moderate risk but requires prior compromise of the renderer process.

A fix is available in Google Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation guidance is provided or required beyond applying the official update.