Use-after-free in Chrome Track component allows sandbox code execution

Use-after-free in Google Chrome's Track component allows code execution inside the sandbox via a crafted HTML page. CVSS 8.8 per NVD; Chromium rates it critical internally. Patched in Chrome 155.

cat cve-2026-106347.json

Vendor: Google
Product: Chrome (Track component, prior to 155.0.8059.39)
CVSS: 8.8
EPSS (exploit probability): N/A
Status: patched
Published: October 7, 2026
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-106347

CVE-2026-106347 is a use-after-free in Google Chrome’s Track component. A remote attacker can exploit it via a crafted HTML page to run code inside the renderer sandbox.

Reported by Xinyang Ge. NVD rates this CVSS 8.8 (high). Chromium’s internal severity label is “critical.” Patched in Chrome 155.0.8059.39, released October 7, 2026. No exploitation in the wild reported.

Related coverage

~/articles/2026-10-07-chrome-155-247-vulnerabilities-four-critical

browser

Chrome 155 Patches 4 Critical UAF Bugs, 247 Total

Google shipped Chrome 155 with 247 fixes, including four critical use-after-free bugs in core browser components. No active exploitation reported yet.

Oct 7read →