Google Chrome: Use-after-free in Modularization allows sandboxed code execution
Summary
A use-after-free flaw in the Modularization component of Google Chrome before 155.0.8059.39 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker only needs to lure a user to a crafted HTML page; no privileges are required, but user interaction is. The description limits impact to the sandbox, so full system compromise would normally require an additional sandbox-escape flaw. Chromium-based browsers such as Microsoft Edge may be affected as well.
Affected
- Google Chrome desktop prior to 155.0.8059.39 (Windows, macOS, Linux)
- Chromium-based browsers that include the affected Chromium code (e.g. Microsoft Edge, Brave, Vivaldi): versions unknown, check the vendor advisories
Fixed in
- Google Chrome 155.0.8059.39 or later (Linux); 155.0.8059.39/.40 or later (Windows, macOS), according to the Chrome Releases stable update of 6 October 2026
- Debian chromium 155.0.8059.39-1~deb12u1
- Microsoft Edge: fixed build not confirmed; check the MSRC advisory
- Newer stable releases (e.g. 156.x) include later fixes for similar issues
Workaround
Unknown. No vendor-recommended workaround has been verified. Updating Chrome is the required fix.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total
- No evidence found that the vulnerability is known to be exploited in the wild
- No public proof of concept found; this does not prove that none exists
Our recommendation
- Update Google Chrome on all desktops to the newest stable version and restart the browser
- Check and update other Chromium-based browsers (Microsoft Edge, Brave, etc.) and follow their vendor advisories
- Verify that automatic updates work and that no extension blocks them
- Monitor for signs of exploitation and check vendor advisories for updates
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker entry issues.chromium.org
- Microsoft Security Update Guide: CVE-2026-106315 msrc.microsoft.com
- OSV: DEBIAN-CVE-2026-106315 osv.dev
- CISA ADP Vulnrichment (mirror) hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:57.
Original description (NVD)
Use after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.