Google Chrome: Use-after-free in Media allows code execution in sandbox
Summary
A use-after-free flaw in the Media component of Google Chrome prior to 155.0.8059.39 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs the victim to open a crafted HTML page. Chromium rates the flaw High and CVSS 3.1 gives it 8.8.
Affected
- Google Chrome prior to 155.0.8059.39
- Desktop builds for Windows, macOS and Linux
- Chromium-based Linux distribution packages before the fixed build
Fixed in
- Google Chrome 155.0.8059.39 or later (Windows and Mac: 155.0.8059.39/.40 per vendor post; Linux: 155.0.8059.39)
- Debian chromium 155.0.8059.39-1~deb12u1
Workaround
- Unknown. No vendor-published workaround. Updating Chrome is the remedy.
- Until updated, restrict browsing of untrusted websites where possible.
Exploitation
- Not listed in CISA KEV; CISA ADP Vulnrichment does not mark it as known exploited.
- No public proof of concept found in the sources reviewed.
- No in-the-wild exploitation known.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Update Google Chrome to 155.0.8059.39 or later on all endpoints.
- Restart Chrome after the update, as the fix only applies after a relaunch.
- Check managed browsers and rarely restarted machines for the installed version.
- Patch other Chromium-based browsers and Linux packages when vendors release fixes.
- Monitor for vendor and CERT advisories on this CVE.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker entry issues.chromium.org
- Ubuntu Security: CVE-2026-106190 ubuntu.com
- OSV: DEBIAN-CVE-2026-106190 osv.dev
- gHacks: Chrome 155 with 247 security fixes www.ghacks.net
- Malwarebytes: Update Chrome to fix critical security issues www.malwarebytes.com
- CISA ADP Vulnrichment record (via HOL Guard) hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:14.
Original description (NVD)
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.