Description
Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-10-06
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an integer overflow in the Media component of Google Chrome before version 155.0.8059.39. An attacker who can deliver a crafted HTML page can exploit the overflow to execute arbitrary code outside the browser sandbox, leading to a full system compromise.

Affected Systems

The flaw exists in Google Chrome, affecting all builds prior to 155.0.8059.39. Users running older Chrome versions are vulnerable. The issue is documented in Chrome's stable channel release for 155.0.8059.39.

Risk and Exploitability

The attack requires only a crafted HTML page and can be initiated remotely. The CVSS score is 9.6, indicating a high severity. EPSS data is not reported, and the vulnerability is not listed in CISA KEV, indicating no known exploitation in the wild so far. Nonetheless, the potential for remote code execution warrants prompt remediation.

Generated by OpenCVE AI on October 7, 2026 at 00:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Chrome to version 155.0.8059.39 or later, as released in the stable channel.
  • Ensure the Chrome sandbox is enabled and that permissions for rendering processes are restricted.
  • Monitor for anomalous process creation or unexpected network activity that might indicate exploitation attempts.

Generated by OpenCVE AI on October 7, 2026 at 00:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Sat, 10 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title Browser Integer Overflow Enables Remote Code Execution chromium-browser: Integer overflow in Media
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 07 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 07 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 06 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Title Browser Integer Overflow Enables Remote Code Execution

Tue, 06 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-190
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-07T03:55:59.886Z

Reserved: 2026-10-06T16:38:33.920Z

Link: CVE-2026-106417

cve-icon Vulnrichment

Updated: 2026-10-06T20:30:45.537Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:18:11.433

Modified: 2026-10-07T13:10:43.117

Link: CVE-2026-106417

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-06T18:41:38Z

Links: CVE-2026-106417 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T00:45:09Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound