CVE-2026-106197

Executive Summary

CVE-2026-106197 is a critical use-after-free (CWE-416) vulnerability in the Browser component of Google Chrome affecting versions prior to 155.0.8059.39. A remote, unauthenticated attacker can trigger the flaw by convincing a victim to open a crafted HTML page, potentially achieving arbitrary code execution outside the browser sandbox. Given the CVSS base score of 9.6 and a Chromium security severity rating of Critical, this represents a high-risk client-side exploitation vector for enterprise endpoints running unpatched Chrome builds.

Technical Analysis

The vulnerability is classified under CWE-416: Use After Free. This class of defect occurs when a program continues to reference memory after it has been freed, resulting in undefined behavior. In the context described by NVD, the flaw resides in the "Browser" component of Google Chrome — the parent process that brokers privileged operations and hosts the UI, network, and GPU services, distinct from the renderer sandbox in which web content normally executes.

The NVD description states that the issue "allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page." This is the critical security property: a use-after-free that is ordinarily contained within the renderer process (and therefore inside the sandbox) has, in this case, been assessed by the vendor as enabling code execution outside the sandbox. That assessment is reflected in the CVSS vector, which assigns Scope:Changed (S:C) — indicating that a successful exploit can impact resources beyond the vulnerable component's security authority — and High Confidentiality, Integrity, and Availability impacts (C:H/I:H/A:H).

The attack surface is the browser's HTML parsing and rendering pipeline as reachable from web content. Because the description references a "crafted HTML page," the trigger is delivered as standard web content and does not require any special network position beyond the ability to serve or inject a page the victim loads. The description does not enumerate the specific object, function, or subsystem within the Browser component that is subject to the use-after-free, and no CNA title or additional technical detail was provided. Accordingly, the precise free/reuse sequence, the lifetime-management defect, and the heap layout required for exploitation cannot be described from the available data. What can be stated with confidence is the vulnerability class (memory lifetime error), the delivery vector (crafted HTML), the affected component (Browser), and the vendor-assessed maximum impact (sandbox escape to arbitrary code execution). The CVSS vector rates Attack Complexity as Low (AC:L) and Privileges Required as None (PR:N), with User Interaction Required (UI:R) — consistent with a drive-by page load being the only precondition.

It should be noted that no public proof-of-concept, exploit code, or Nuclei template was identified in the provided data, and the CVE is not listed in CISA KEV. The absence of a public exploit does not reduce the significance of a sandbox-escaping use-after-free in a browser with Chrome's install base; historically, such defects in the Browser parent process are high-value targets for chained exploitation.

Exploitation Scenarios

No public PoC or exploit code is available for this CVE; the attack chain below is inferred from the vulnerability class (CWE-416) and the vendor-supplied impact statement, and does not include specific function names, object layouts, or offsets, because none were provided.

1. Reconnaissance and target identification. An attacker identifies victims running Google Chrome versions below 155.0.8059.39. This information can be gathered from user-agent strings observed by attacker-controlled web properties, malvertising infrastructure, or phishing pages, since the browser advertises its version in HTTP requests by default. No authentication or network vantage point is required; the attacker only needs the victim to load a page.

2. Delivery and triggering of the flaw class. The attacker hosts or injects a "crafted HTML page" — as stated verbatim in the NVD description — that exercises the affected Browser component code path. Triggering a use-after-free requires the page to drive the browser into an object lifetime state where memory is released and subsequently accessed. The page serves as the weaponized delivery vehicle; the attacker's goal at this stage is a memory-safety violation inside the Browser component rather than the renderer sandbox.

3. Payload and execution method (class level). Because the defect is a use-after-free, the exploitation primitive is memory corruption. At the vulnerability-class level, the attacker's objective is to seize control of a freed-and-reused memory region and redirect execution or corrupt an object's contents to run attacker-chosen code. The NVD description explicitly states the outcome the vendor assessed: execution of arbitrary code outside the sandbox. The attacker does not need to supply a separate binary payload to trigger the flaw; the "crafted HTML page" is the complete delivery mechanism described. Any secondary payload staging, code-gadget selection, or heap-shaping technique is not described in the provided data and must not be assumed.

4. Post-exploitation impact. If the use-after-free is exploited as the vendor assessment indicates, the attacker gains code execution outside the sandbox — i.e., at the privilege level of the browser process rather than confined to the renderer. With Scope:Changed and High C/I/A impacts per the CVSS vector, the consequences span data theft from endpoints, arbitrary manipulation of browser and user data, and potential escalation to broader host compromise. From there, an attacker could persist on the endpoint, harvest credentials or session tokens, or pivot into the corporate network, depending on the host's configuration and protections. Note that the description refers specifically to execution outside the sandbox; it does not claim operating-system-level kernel privilege escalation, and none should be assumed.

Impact Assessment

The CVSS 3.1 base score is 9.6, composed of AV:N (network-reachable delivery of the crafted page), AC:L (no specialized conditions per the vendor's rating), PR:N (no credentials needed), UI:R (victim must load the page), S:C (impacts extend beyond the vulnerable component), and C:H/I:H/A:H (total loss of confidentiality, integrity, and availability for the affected scope).

Affected systems are endpoints running Google Chrome versions earlier than 155.0.8059.39. Given Chrome's dominant enterprise market share, the blast radius is potentially the entire managed desktop and laptop fleet in the common (and now widely deployed) case where Chrome is the default browser, including BYOD devices accessing corporate resources. The business impact is severe: sandbox escape in a browser is the classic precondition for endpoint compromise, and a successful exploit could result in theft of intellectual property, credential and session-token theft, deployment of further tooling, and lateral movement into internal networks.

Risk is currently elevated by the fact that patch confidence is assessed at 0/4 — no patch evidence was identified from any tracked source at the time of this analysis — and no workarounds are documented. Conversely, risk is moderated in the near term by the absence of a public PoC or exploit code, and by the fact that the CVE is not listed in CISA KEV, meaning no confirmed exploitation in the wild was reported in the provided data. The CVE's Chromium security severity is rated Critical, so defenders should treat fix availability as time-sensitive. EPSS has not yet been scored by FIRST.org; no EPSS estimate should be inferred.

Detection Guidance

Sigma Rule

title: Suspicious Chrome Process Spawning Child Process After Web Browsing
id: 9f1c0a2e-7b44-4d3a-9c21-10619a7b5e01
status: experimental
description: Detects Chrome spawning unexpected child processes, which may indicate post-exploitation activity following a browser memory-corruption exploit such as CVE-2026-106197.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106197
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
  selection_susp_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\curl.exe'
  condition: selection_parent and selection_susp_child
falsepositives:
  - Legitimate browser extensions or enterprise tooling launching scripts
level: high
tags:
  - attack.t1203
  - cve.2026.106197

YARA Rule

rule EXPLOIT_CVE_2026_106197_Chrome_UseAfterFree
{
    meta:
        description = "Detects HTML content matching common heap-spray and browser exploit delivery patterns that may be associated with CVE-2026-106197"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106197"
        cve = "CVE-2026-106197"
        severity = "critical"
        date = "2026-01-01"

    strings:
        $html1 = "<html" ascii nocase
        $script1 = "<script" ascii nocase
        $spray1 = "ArrayBuffer" ascii
        $spray2 = "Uint32Array" ascii
        $spray3 = "Float64Array" ascii
        $spray4 = "DataView" ascii
        $spray5 = "WebAssembly" ascii
        $heap1 = "unescape(" ascii
        $heap2 = "%u" ascii
        $chain1 = "Function(" ascii
        $chain2 = "eval(" ascii

    condition:
        $html1 and $script1 and 3 of ($spray*) and 1 of ($heap*, $chain*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"EXPLOIT Possible Chrome Use-After-Free Exploit Delivery CVE-2026-106197 (scripted browser exploitation)"; flow:established,to_client; http.response_body; content:"<script"; nocase; http.response_body; content:"ArrayBuffer"; nocase; http.response_body; content:"DataView"; nocase; http.response_body; pcre:"/(%u[0-9a-fA-F]{4}){50,}/"; threshold:type limit, track by_src, seconds 60, count 1; reference:cve,2026-106197; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106197; classtype:attempted-user; sid:2026106197; rev:1;)

Elastic Detection

process where host.os.type == "windows" and
event.type == "start" and
process.parent.name : ("chrome.exe", "chrome") and
process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
                 "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe",
                 "curl.exe", "bitsadmin.exe") and
not process.parent.args : "--type=renderer"

Splunk SPL Query

index=main (sourcetype=WinEventLog:Security EventCode=4688 OR sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1)
| eval parent=coalesce(ParentImage, ParentImage)
| eval child=coalesce(NewProcessName, Image)
| where like(parent, "%chrome.exe%") AND (like(child, "%cmd.exe") OR like(child, "%powershell.exe") OR like(child, "%pwsh.exe") OR like(child, "%wscript.exe") OR like(child, "%mshta.exe") OR like(child, "%rundll32.exe") OR like(child, "%cscript.exe") OR like(child, "%regsvr32.exe"))
| table _time, host, user, parent, child, CommandLine
| sort - _time

Wazuh OSSEC Rule

<group name="windows,sysmon,exploit,">
  <rule id="106197" level="12">
    <if_group>sysmon_event1</if_group>
    <field name="win.eventdata.parentImage">\\\\chrome\.exe$</field>
    <field name="win.eventdata.image">\\\\(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32)\.exe$</field>
    <description>CVE-2026-106197: Possible post-exploitation child process spawned by Google Chrome (sandbox escape indicator)</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>cve_2026_106197,</group>
  </rule>
</group>

Detection caveat: because the NVD description does not disclose specific function names, memory structures, or URL patterns, the rules above target the behavioral consequence of a browser sandbox escape (unexpected child processes, scripted exploit-delivery characteristics in HTTP responses) rather than a signature unique to this CVE. They should be tuned to the environment to limit false positives from legitimate extension or automation activity.

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED per the tracked evidence, and no vendor fix, workaround, or affected-version list was provided in the source data. Although the NVD description references version 155.0.8059.39 as the fixed release, this analysis did not identify independent patch evidence from any tracked source, so the following guidance is prioritized accordingly.

1. Immediate mitigations (until patching is verified):

   • Restrict or disable browser use for high-value workflows where possible, and enforce strict content controls.
   • Deploy network and email filtering to block known malicious or untrusted HTML delivery sources; reduce exposure to malvertising and untrusted web content.
   • Enable browser features that reduce exploitability: site isolation, strict site permissions, and (where supported in managed policy) additional renderer hardening.
   • Consider application allowlisting / endpoint detection and response (EDR) with behavior-based rules (see Detection Guidance) to catch post-exploitation child processes.
   • Monitor vendor channels closely: because this CVE is rated Critical by Chromium, a stable-channel fix is likely imminent and should be treated as urgent once released.

2. Patch / upgrade steps:

   • Upgrade Google Chrome to version 155.0.8059.39 or later as soon as the vendor stable-channel build is available.
   • Use enterprise management (e.g., Chrome Browser Cloud Management, Group Policy, or MDM) to enforce auto-update and verify the reported version across the fleet.
   • Do not rely on interim workarounds alone; because the vulnerability is in the Browser component and rated Critical, version upgrade is the definitive remediation.

3. Long-term hardening:

   • Maintain aggressive browser update SLAs for internet-facing client software, with automated compliance reporting.
   • Harden endpoints with exploit mitigations (ASLR, DEP, CFG/CET where available) and least-privilege user accounts.
   • Layer defenses so that a browser sandbox escape is not immediately host-compromising: EDR, application control, credential protection, and network segmentation.
   • Track new Chrome releases and Chromium security advisories for exploitation-in-the-wild updates, and re-evaluate risk if the CVE is added to CISA KEV or a public exploit emerges.

References

• NVD — CVE-2026-106197: https://nvd.nist.gov/vuln/detail/CVE-2026-106197
• CWE-416: Use After Free — MITRE: https://cwe.mitre.org/data/definitions/416.html
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• Google Chrome Releases (stable channel advisories): https://chromereleases.googleblog.com/
• FIRST EPSS (score not yet assigned for this CVE): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence were identified in the provided data. The CVE is not listed in CISA KEV, no public PoC or exploit code was found, and no Nuclei template exists per the source data.