Google Chrome: Use-after-free in Network component allows code execution
Summary
Google Chrome desktop versions before 155.0.8059.39 contain a use-after-free vulnerability in the Network component (CWE-416). A remote attacker who uses social engineering to get a victim to install or use a crafted Chrome extension could potentially execute arbitrary code outside the browser sandbox. Google rates the Chromium security severity as Low, while the CVSS 3.1 base score is 9.6 (Critical).
Affected
- Google Chrome desktop versions before 155.0.8059.39
- Chromium-based browsers that include the same fix, for example Microsoft Edge (exact fixed build to be checked with the vendor)
Fixed in
- Google Chrome 155.0.8059.39 or later (Windows, Mac and Linux; Google's post also lists 155.0.8059.40 for Windows and Mac)
- Debian 12: chromium 155.0.8059.39-1~deb12u1
- Newer stable builds are available; check the current Chrome stable channel
- Ubuntu: update the Chromium snap (snap revision not verified)
Workaround
Unknown.
- No vendor-documented workaround for this CVE was found.
- Restricting extension installation via policy reduces the attack path, but is not a fix.
Exploitation
- No evidence of exploitation in the wild found in the sources reviewed.
- No public proof-of-concept found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS is very low (about 0.003).
Our recommendation
- Update Google Chrome and other Chromium-based browsers to the current stable build on all endpoints.
- Check Linux systems separately, including Debian packages and Ubuntu Chromium snaps.
- Restrict browser extension installation to an approved list, for example via Chrome Enterprise policy, and remove unneeded extensions.
- Train users to be cautious with extension installation requests.
- Monitor for vendor updates or CISA reports of active exploitation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker 564085088 issues.chromium.org
- Ubuntu security tracker CVE-2026-106234 ubuntu.com
- OSV Debian CVE-2026-106234 osv.dev
- SUSE CVE tracker CVE-2026-106234 vulners.com
- Malwarebytes: Update Chrome and ChromeOS to fix critical security issues www.malwarebytes.com
- CIS advisory on multiple Google Chrome vulnerabilities www.cisecurity.org
- Chrome Enterprise: Manage Chrome release channels support.google.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:17.
Original description (NVD)
Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Low)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.