Use-after-free in Chrome Browser component enables sandbox RCE

Use-after-free in Google Chrome's Browser component allows remote code execution inside the sandbox via a crafted HTML page. CVSS 9.6. Patched in Chrome 155.

cat cve-2026-106197.json

Vendor: Google
Product: Chrome (Browser component, prior to 155.0.8059.39)
CVSS: 9.6
EPSS (exploit probability): N/A
Status: patched
Published: October 7, 2026
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-106197

CVE-2026-106197 is a use-after-free vulnerability in the Browser component of Google Chrome. A remote attacker can exploit it to execute code inside the renderer sandbox by serving a crafted page.

Reported by researcher Xinyang Ge using AI-assisted vulnerability research techniques. Patched in Chrome 155.0.8059.39 (all platforms), released October 7, 2026. Google reports no active exploitation.

Related coverage

~/articles/2026-10-07-chrome-155-247-vulnerabilities-four-critical

browser

Chrome 155 Patches 4 Critical UAF Bugs, 247 Total

Google shipped Chrome 155 with 247 fixes, including four critical use-after-free bugs in core browser components. No active exploitation reported yet.

Oct 7read →