CVE-2026-106347

Executive Summary

CVE-2026-106347 is a use after free (UAF) vulnerability in the "Track" component of Google Chrome prior to version 155.0.8059.39. A remote attacker can trigger the flaw by convincing a victim to load a crafted HTML page, leading to memory corruption that can be exploited to execute arbitrary code inside the browser sandbox. With a CVSS v3.1 base score of 8.8 and a Chromium security severity rating of Critical, this is a high-impact, remotely exploitable issue affecting all users on unpatched Chrome builds.

Technical Analysis

The vulnerability is classified under CWE-416 (Use After Free), a memory-safety flaw in which an object is used after its memory has been freed. In a UAF condition, a program holds a stale reference (dangling pointer) to a memory region that has been deallocated. If an attacker can control the contents that are subsequently written into that freed memory region — a technique commonly referred to as heap grooming or heap spraying — the dangling reference can be made to point to attacker-influenced data. When the program then dereferences the stale reference, it operates on attacker-controlled memory, which can be leveraged to hijack control flow or corrupt internal state.

Per the NVD description, the defect resides in the "Track" component of Chrome, and the attack vector is a crafted HTML page loaded by the victim. This places the flaw squarely in the browser's rendering/parsing attack surface, which is the most exposed component of a modern browser: any web page a user visits can supply the triggering markup. The "remote attacker" framing confirms that no local access is required — the attacker only needs the victim to navigate to a malicious or compromised page (or be served attacker-controlled content through ad networks, malicious redirects, or injected third-party resources).

The sandbox context is central to the risk profile. Chrome renders web content in a sandboxed renderer process with a lowered privilege level, and a code-execution primitive obtained inside the sandbox is contained by the sandbox boundary. However, sandbox escape is a separate, independent primitive — UAF conditions in browser internals are historically the starting point for full-chain exploits that chain a renderer compromise with an OS-level sandbox escape. Chromium's Critical severity rating reflects that this flaw yields a controllable memory-corruption primitive in a component reachable from untrusted web content.

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates: network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and user interaction required (UI:R) — consistent with a drive-by web page load. Confidentiality, integrity, and availability impacts are all High (C:H/I:H/A:H), and the scope is Unchanged (S:U), meaning the compromise is evaluated as affecting the vulnerable component's security authority. The subscore pattern makes this a severe memory-corruption issue: successful exploitation can expose data, allow unauthorized modification, and disrupt availability within the affected process context.

Because the public description does not enumerate the specific class, function, or code path within the "Track" component, no code-level implementation detail can be asserted here. The accurate characterization is: a use-after-free reachable via attacker-crafted HTML in a pre-155.0.8059.39 Chrome build, presenting a memory-corruption primitive inside the renderer sandbox. No public proof-of-concept, exploit code, or Nuclei template is available for this CVE at this time, and the CVE has not been added to the CISA Known Exploited Vulnerabilities catalog.

Exploitation Scenarios

The following attack chain is described at the vulnerability-class level and is inferred from the NVD description, which specifies a UAF in Chrome's "Track" component triggered by a crafted HTML page. No public PoC exists; the sequence below reflects the standard exploitation model for this class of bug and does not assert specific function names or code paths not present in the source data.

1. Reconnaissance / target identification. The attacker identifies targets running a vulnerable Chrome build (versions prior to 155.0.8059.39). On a broad scale, this attack is not targeted at all: because the trigger is simply loading a crafted HTML page, any user running an affected Chrome build is a potential victim. The attacker's practical reconnaissance is to determine which Chrome versions remain unpatched and to locate delivery channels — malicious or compromised websites, malvertising networks, injected third-party scripts, or malicious redirects — that will cause a victim's browser to render the crafted page.

2. Triggering the flaw class. The victim navigates to the attacker-controlled or attacker-compromised page. The page's HTML/JavaScript is parsed and rendered by the affected "Track" component. The crafted markup drives the component into a state where it frees an object and then continues to reference it — the use-after-free condition. The attacker arranges, through repeated allocations and controlled content (heap grooming), that the freed memory slot is reallocated with attacker-influenced data, so that the subsequent use dereferences controlled memory rather than a valid object. The precise markup and timing required are not disclosed in the available data.

3. Execution method at the vulnerability-class level. Once the dangling reference resolves to attacker-controlled data, the corrupted object state can be manipulated to redirect execution within the compromised process. In the Chromium exploitation model, this yields an arbitrary-code-execution primitive inside the renderer sandbox. This is the key scope limitation: the primitive is constrained by the sandbox, so full system compromise would require an additional, independent sandbox-escape vulnerability — a separate step that is not provided by CVE-2026-106347 itself.

4. Post-exploitation impact. With code execution inside the sandboxed renderer, an attacker could read and manipulate page content and potentially browser-renderer process memory accessible from the sandbox — consistent with the High confidentiality and integrity subscore in the CVSS vector. Achieving broader host or enterprise compromise would require the attacker to chain a sandbox escape. Even short of that, code execution in the browser's rendering tier is a serious foothold for credential theft, session manipulation, and delivery of further payloads via a compromised browsing session.

Impact Assessment

The blast radius is the entire population of Chrome users running versions prior to 155.0.8059.39 who browse the web — effectively every unpatched Chrome endpoint in an enterprise. Because delivery is a crafted HTML page, exposure is continuous: users do not need to install anything, visit a suspicious file share, or interact with an email attachment. Visiting an attacker-influenced page is sufficient. This makes the vulnerability reachable by external parties with no credentials and no network position beyond the ability to serve web content to a victim (AV:N, PR:N).

The CVSS v3.1 base score of 8.8 reflects high potential impact: High Confidentiality (C:H), High Integrity (I:H), and High Availability (A:H). Scope is Unchanged (S:U), meaning the impact is assessed within the vulnerable component's security authority, and the UI:R metric reflects that a page load — a routine user action — is the required trigger. Chromium's own security severity rating of "Critical" places this in the highest severity tier used by the Chrome Security Team, reserved for cases with realistic, serious exploitation potential.

Business impact includes: drive-by compromise risk for browsing workforces; potential theft of credentials, session tokens, or data visible to a compromised renderer context; and the operational cost of emergency browser patching across large fleets. For organizations that allow personal browsing on managed endpoints, or that operate high-value web-facing user populations, the practical risk is elevated. There is no EPSS score available (the CVE is not yet scored by FIRST.org), and no evidence of CISA KEV listing or in-the-wild exploitation is provided. Absent that confirmation, the vulnerability should still be treated as high priority because it is a memory-corruption primitive reachable from untrusted content in a Critical-severity browser component with no public patch confidence recorded.

Detection Guidance

Detection centers on the fact that exploitation involves a crafted HTML page producing memory-corruption behavior in Chrome prior to 155.0.8059.39. Because the public description does not disclose specific URL patterns, JavaScript APIs, or object names, the detection rules below focus on version-based exposure, suspicious renderer behavior, and generic memory-corruption indicators rather than CVE-specific byte signatures. These rules are intended as a starting point and require tuning to the environment.

Sigma Rule

title: Potential Chrome Use-After-Free Exploitation Attempt (CVE-2026-106347)
id: 9b3c1f42-7d2e-4a11-9c5e-0f6a7b2d8e10
status: experimental
description: Detects Chrome child (renderer) process crashes or terminations consistent with use-after-free corruption in versions prior to 155.0.8059.39
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106347
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection_chrome:
    Image|endswith:
      - '\chrome.exe'
      - '\chromium.exe'
  selection_version:
    CommandLine|contains: '--type=renderer'
  filter_crashpad:
    CommandLine|contains: '--type=crashpad-handler'
  condition: selection_chrome and selection_version and not filter_crashpad
fields:
  - Image
  - CommandLine
  - ParentImage
falsepositives:
  - Normal renderer process spawning behavior
  - Legitimate tab isolation processes
level: low

YARA Rule

rule Chrome_UAF_Track_CVE_2026_106347
{
    meta:
        description = "Heuristic detection of crafted HTML payloads attempting Chrome use-after-free abuse (CVE-2026-106347)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106347"
        date = "2026-01-01"
        severity = "high"

    strings:
        $js1 = "ArrayBuffer" ascii wide nocase
        $js2 = "DataView" ascii wide nocase
        $js3 = "WebAssembly" ascii wide nocase
        $js4 = "requestAnimationFrame" ascii wide nocase
        $js5 = "use-after-free" ascii wide nocase
        $heap1 = "%n%n%n%n" ascii
        $heap2 = "\\u4141\\u4141" ascii nocase
        $heap3 = "41414141" ascii

    condition:
        uint32be(0) == 0x3C21444F or uint32be(0) == 0x3C68746D or
        (3 of ($js*) and 1 of ($heap*))
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-106347 Possible Chrome Use-After-Free Exploitation (Crafted HTML)"; flow:established,to_server; content:"User-Agent|3a 20|"; http_header; pcre:"/User-Agent\x3a\s[^\r\n]*(Chrome|Chromium)\/(1[0-5][0-9]|[0-9]{1,2})\./Hi"; threshold: type limit, track by_src, count 1, seconds 60; reference:cve,2026-106347; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106347; classtype:attempted-user; sid:2026106347; rev:1;)

Note: this rule flags HTTP requests from Chrome versions below the 155.x series as exposure indicators; it is a version-based heuristic, not a CVE-specific exploit signature, because no exploit byte pattern is publicly available.

Elastic Detection

process where event.type == "start" and
  process.name : ("chrome.exe", "chromium.exe") and
  process.command_line : "*--type=renderer*" and
  process.parent.name : ("chrome.exe", "chromium.exe")

Pair this process-start logic with crash telemetry (Crashpad reports referencing Chrome renderer terminations) in the same timeframe to surface repeated renderer crashes consistent with memory corruption.

Splunk SPL Query

index=endpoint (process_name="chrome.exe" OR process_name="chromium.exe")
| search (CommandLine="*--type=renderer*" OR CommandLine="*--type=crashpad-handler*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(CommandLine) as cmdlines by host, user, process_name
| where count > 5
| sort - count
| rex field=cmdlines "Chrome/(?<chrome_ver>\d+\.\d+\.\d+\.\d+)"
| where chrome_ver != ""

Wazuh OSSEC Rule

<group name="windows,chrome,">
  <rule id="2026106" level="3">
    <if_sid>61600</if_sid>
    <field name="win.eventdata.image">chrome\.exe$|chromium\.exe$</field>
    <field name="win.eventdata.commandLine">--type=renderer</field>
    <description>Chrome renderer process started - monitor for repeated crashes (possible CVE-2026-106347 use-after-free exploitation)</description>
  </rule>

  <rule id="2026107" level="10" frequency="5" timeframe="120">
    <if_matched_sid>2026106</if_matched_sid>
    <same_field>win.eventdata.parentImage</same_field>
    <description>Repeated Chrome renderer restarts in short window - possible memory corruption exploitation (CVE-2026-106347)</description>
    <mitre>
      <id>T1189</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description identifies version 155.0.8059.39 as the fixed release, but no vendor advisory, patch commit, or tracked patch source currently corroborates remediation status; treat patch availability as unverified and confirm directly with the vendor.

1. Immediate mitigations
   • Verify the exact Chrome build in use across the fleet. Any version prior to 155.0.8059.39 is in scope. Upgrade to 155.0.8059.39 or later as soon as a trusted vendor build is confirmed.
   • Until patched builds are validated and deployed, reduce exposure: restrict uncontrolled web browsing on high-value endpoints, enforce strict egress filtering where feasible, and consider script-blocking or reduced-content policies for untrusted browsing destinations.
   • Enable and monitor renderer crash telemetry (Crashpad reports) and alert on repeated renderer terminations, which can indicate memory-corruption exploitation attempts.
   • Ensure Chrome auto-update is functioning so endpoints receive fixed builds as they become available; audit for update-blocked or pinned-version endpoints.

2. Patch / upgrade steps

   • Confirm availability of Chrome 155.0.8059.39 (or a later build) from the official distribution channel. Since this CVE is marked UNPATCHED with zero patch confidence, do not assume availability — validate the release and its release notes before mass deployment.
   • For managed fleets, push the update via your enterprise management tooling (Chrome Browser Cloud Management, GPO, MDM, or software distribution). Prioritize high-risk user groups.
   • For Chromium-based derivatives (if any are deployed), verify whether they have independently incorporated the upstream fix, as their patching cadence may differ.

3. Long-term hardening

   • Maintain a rapid browser patching program; browsers are the highest-exposure attack surface in most enterprises.
   • Keep Chromium sandboxing and site isolation fully enabled — while sandboxing does not prevent this class of in-sandbox code execution, it limits the blast radius and forces attackers to chain an additional escape primitive.
   • Deploy network and endpoint detection for drive-by delivery (malvertising, malicious redirects, injected third-party scripts), since the trigger for this CVE is loading attacker-supplied web content.
   • Track vendor advisories and CISA KEV status; if exploitation is later confirmed in the wild, escalate remediation to emergency-change priority.

References

• NVD — CVE-2026-106347: https://nvd.nist.gov/vuln/detail/CVE-2026-106347
• MITRE CWE-416 — Use After Free: https://cwe.mitre.org/data/definitions/416.html
• MITRE ATT&CK T1189 — Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
• Google Chrome release notes and security advisories (verify fixed version 155.0.8059.39 in the official Chrome release channel): https://chromereleases.googleblog.com/
• CISA Known Exploited Vulnerabilities catalog (check current status; not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaign and exploit-in-the-wild evidence: none provided in the source data. No public PoC, exploit code, or Nuclei template is known for this CVE, and it is not listed in CISA KEV at this time.