Google Chrome: Use-after-free in Chrome Tabs allows code execution outside sandbox
Summary
A use-after-free (CWE-416) in the Tabs component of Google Chrome on macOS can be triggered by a crafted HTML page. A remote attacker who lures a user to such a page could potentially execute arbitrary code outside the browser sandbox. The CVSS base score is 9.6 (critical) and the Chromium severity is High. User interaction is required, for example by visiting a malicious link.
Affected
- Google Chrome on macOS prior to 155.0.8059.39 (per CVE record)
- The vendor advisory covers Windows and Linux with the same release; the CVE record lists only macOS.
Fixed in
- Google Chrome 155.0.8059.39 or later on macOS. The vendor advisory also lists 155.0.8059.40 for Mac; the exact minimum build is not fully confirmed.
- Install the current stable release, as newer builds have been published since.
Workaround
Unknown. No workaround is known; apply the update. Chrome applies updates only after a restart.
Exploitation
- No known exploitation in the wild according to the sources reviewed. The CISA KEV catalogue was not checked directly.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- No public proof of concept found.
Our recommendation
- Check the Chrome version on all managed Macs via MDM or the About Google Chrome page and update to the latest stable build.
- Restart Chrome after the update so the fix takes effect.
- Prioritise Macs used for general web browsing; also update Windows and Linux systems.
- Monitor for unexpected browser crashes or suspicious activity on Chrome-based systems.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- HKCERT security bulletin: Google Chrome multiple vulnerabilities www.hkcert.org
- Malwarebytes: Chrome update fixes 37 security flaws www.malwarebytes.com
- CISA ADP enrichment (HOL Guard) hol.org
- OffSeq Radar: Chromium CVE-2026-106298 radar.offseq.com
- OSV: Debian advisory for CVE-2026-106298 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:16.
Original description (NVD)
Use after free in Chrome Tabs in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.