Google Chrome: Use-after-free in Fonts component
Summary
A use-after-free flaw in the Fonts component of Google Chrome on Windows allows a remote attacker to execute arbitrary code inside the browser sandbox. Exploitation requires that a user visits a crafted HTML page. The CVE record describes code execution inside the sandbox and does not describe a sandbox escape. The CVSS score is 8.8 (High), while Chromium rates the issue Medium.
Affected
- Google Chrome on Windows prior to 155.0.8059.39
- Conflicting build data in the sources: one source names 154.0.8037.39/.40 for Windows and Mac. Verify against the Chrome Releases advisory.
Fixed in
- Chrome 155.0.8059.39 or later (version range in the CNA record)
- The latest stable build is recommended. A later stable update (155.0.8059.84/.85 for Windows and Mac) reportedly also covers this CVE.
Workaround
- Unknown. The CVE record provides no workaround.
- Update and restart the browser: open About Google Chrome, check for updates, then click Relaunch.
Exploitation
- CISA KEV: not listed.
- CISA SSVC: Exploitation none, Automatable no.
- No public proof of concept found. No in-the-wild exploitation reported in the sources reviewed.
Our recommendation
- Confirm that all Windows Chrome installations run 155.0.8059.39 or later, preferably the latest stable build.
- Force a browser restart on endpoints whose browser sessions have been open for a long time.
- Verify the exact Windows build number in the Chrome Releases advisory.
- Monitor CISA KEV and public proof-of-concept sources.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue 523699645 issues.chromium.org
- OpenCVE: CVE-2026-106373 app.opencve.io
- Strix: CVE-2026-106373 www.strix.ai
- Malwarebytes: Update Chrome to fix critical security issues www.malwarebytes.com
- GBHackers: Chrome 155 security flaws gbhackers.com
- OSV: DEBIAN-CVE-2026-106373 osv.dev
- Ubuntu CVE tracker: CVE-2026-106373 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:46.
Original description (NVD)
Use after free in Fonts in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.