Description
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-10-06
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution within the Chrome sandbox
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free flaw in the Media component of Google Chrome allows a remote attacker to execute arbitrary code within the browser’s sandbox. The bug is triggered by a specially crafted HTML page and is identified as a CWE‑416 weakness. If successfully exploited, the attacker can run code with the sandbox’s limited privileges, potentially escaping the sandbox or compromising the host system depending on additional conditions.

Affected Systems

Google Chrome versions prior to 155.0.8059.39 are affected. The vulnerability lies in the Media subsystem and applies to builds of the stable channel. Users running versions earlier than the mentioned version should consider them vulnerable until the patch is applied.

Risk and Exploitability

The vulnerability carries a high security severity in Chromium’s internal scoring, and the CVSS score is 8.8, indicating a high risk. The EPSS score is not available. It is not yet listed in the CISA KEV catalog. The attack vector is remote via a crafted web page; therefore any device that renders untrusted HTML content is at risk. Because the flaw allows code execution inside the sandbox, impact to the operating system depends on the effectiveness of sandbox escape mechanisms.

Generated by OpenCVE AI on October 7, 2026 at 02:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Chrome to the latest stable release (≥155.0.8059.39) or apply the security patch provided in the October 2026 stable channel update.
  • Enable automatic updates for Chrome so future patches are applied without manual intervention.
  • Limit exposure to untrusted web content by using content‑security policies or restricting JavaScript execution in potentially risky contexts until the patch is deployed.

Generated by OpenCVE AI on October 7, 2026 at 02:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Sat, 10 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title chromium-browser: Use after free in Media
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 08 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 07 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 06 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-07T03:56:05.108Z

Reserved: 2026-10-06T16:30:26.935Z

Link: CVE-2026-106190

cve-icon Vulnrichment

Updated: 2026-10-06T19:41:08.039Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:17:45.097

Modified: 2026-10-08T13:06:43.923

Link: CVE-2026-106190

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-06T18:41:13Z

Links: CVE-2026-106190 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T05:15:12Z

Weaknesses