CVE-2026-106358

Executive Summary

CVE-2026-106358 is a use-after-free (CWE-416) vulnerability in the Navigation component of Google Chrome affecting all versions prior to 155.0.8059.39. A remote attacker can trigger memory corruption by convincing a victim to open a crafted HTML page, potentially leading to arbitrary code execution outside the browser sandbox. With a CVSS 3.1 base score of 9.6 and Chromium security severity rated Critical, this is a high-priority client-side threat requiring immediate browser fleet remediation, though no public proof-of-concept or in-the-wild exploitation is currently documented.

Technical Analysis

The vulnerability resides in Chrome's Navigation subsystem — the component responsible for managing navigation requests, document lifecycle transitions, and the associated renderer/browser-process state. The NVD description classifies the flaw as a use-after-free (CWE-416), meaning a memory object is accessed after it has been freed but before the associated pointer has been cleared or the reference invalidated.

Use-after-free conditions in browser navigation code typically arise when asynchronous navigation events (redirects, frame teardown, history state changes, or cross-origin transitions) race against object destruction. Because the Navigation component straddles the browser process and renderer process boundary, improper lifetime management of navigation-related objects is a well-established class of sandbox-escape-adjacent defects: memory corruption occurring in a privileged process context can be leveraged to escape the renderer sandbox.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H describes the following characteristics:

• Attack Vector (N): Exploitable over the network — the attacker delivers the trigger via a served web page.
• Attack Complexity (L): No specialized conditions beyond normal exploitation prerequisites.
• Privileges Required (N): No authentication needed on the target.
• User Interaction (R): The victim must navigate to / open the crafted HTML page.
• Scope (C): Changed — exploitation can affect components beyond the vulnerable Navigation component's security scope, consistent with the "outside the sandbox" code execution impact.
• Confidentiality / Integrity / Availability (H/H/H): Full compromise of each.

Per the description, the impact is explicit: a remote attacker can "execute arbitrary code outside the sandbox." This indicates the primitive is not confined to the renderer process and escalates to broader host code execution. No specific function names, class names, or internal object identifiers are provided in the source data, and none are asserted here.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class and the NVD description, which states a remote attacker executes arbitrary code outside the sandbox via a crafted HTML page. No public PoC is available. The following describes the vulnerability class rather than any specific implementation.

1. Reconnaissance / target identification. The attacker identifies targets running Chrome versions below 155.0.8059.39. This can be done passively (fingerprinting browser version via user-agent or client-side feature detection on a controlled page) or by leveraging watering-hole or malvertising infrastructure that serves content broadly and filters by browser build.

2. Trigger. The victim opens a crafted HTML page — delivered via a malicious site, a compromised legitimate site, a malicious ad iframe, or a phishing link. The page drives the Navigation component into the use-after-free condition by causing navigation-related objects to be freed while still referenced (e.g., through rapid or conflicting navigation events). The exact triggering sequence is deliberately obfuscated in the wild and is not documented in the available data.

3. Memory corruption and execution. The dangling reference is reused, allowing the attacker to influence memory contents. Per the NVD description, this escalates to arbitrary code execution outside the sandbox — implying the corrupted object is reachable from a privileged context, enabling escape of the renderer sandbox rather than containment within it.

4. Post-exploitation impact. Successful exploitation yields code execution at the level implied by "outside the sandbox," enabling host-level access consistent with the CVSS Scope:Changed, C/I/A:High ratings. From there an attacker could deploy secondary payloads, harvest credentials, establish persistence, or pivot within the enterprise network.

No function names, endpoints, or parameters are asserted because none appear in the source data.

Impact Assessment

Business impact is high. Chrome is ubiquitous in enterprise environments, and a Critical-severity, network-deliverable, low-complexity use-after-free with sandbox escape implications represents a significant risk to endpoint integrity. Blast radius covers any endpoint running an affected Chrome build — workstations, VDI images, kiosks, and developer machines alike. Because the CVSS scope is Changed and all three CIA impacts are High, a successful exploit is treated as a full host compromise rather than a contained browser crash. The Attack Complexity:Low and Privileges Required:None subscores mean a broadly distributed lure (watering hole, malvertising, phishing email) can reach many victims simultaneously. Browser-based client-side exploits of this class are frequently weaponized in exploit kits and targeted campaigns once technical details circulate, even when no public PoC exists at disclosure.

Detection Guidance

Sigma Rule

title: Potential Chrome Navigation Use-After-Free Exploitation (CVE-2026-106358)
id: 8f3c1e2a-9b47-4d1e-a6c2-7e5f0d3b8a91
status: experimental
description: Detects Chrome process crashes/restarts consistent with Navigation use-after-free exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106358
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_chrome:
    Image|endswith:
      - '\chrome.exe'
  selection_anomaly:
    CommandLine|contains:
      - '--no-sandbox'
      - '--disable-web-security'
  condition: selection_chrome and selection_anomaly
fields:
  - Image
  - CommandLine
  - ParentImage
falsepositives:
  - Developer testing with security flags disabled
level: medium

YARA Rule

rule CVE_2026_106358_Chrome_Navigation_UAF
{
    meta:
        description = "Heuristic detection of Chrome Navigation use-after-free exploit artifacts in memory dumps or crash data"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106358"
        cve = "CVE-2026-106358"
        severity = "critical"
        date = "2026-01-01"

    strings:
        $nav = "Navigation" ascii wide
        $uaf = "use-after-free" ascii nocase
        $chrome_ver = /Chrome\/1[0-4][0-9]\./ ascii
        $hex_nop = { 90 90 90 90 90 90 90 90 }
        $heap_spray = { 0C 0C 0C 0C 0C 0C 0C 0C }

    condition:
        uint16(0) == 0x5A4D and
        filesize < 50MB and
        (($chrome_ver and $uaf) or ($nav and 2 of ($hex_nop, $heap_spray)))
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Potential Chrome Navigation UAF Exploit Delivery CVE-2026-106358"; flow:established,to_server; content:"User-Agent|3A|"; http_header; content:"Chrome/"; http_header; pcre:"/Chrome\/(1[0-4][0-9]|[0-9]{1,2})\.[0-9]+/U"; reference:cve,CVE-2026-106358; classtype:attempted-user; sid:2026106358; rev:1;)

Elastic Detection

sequence by host.hostname with maxspan=5s
  [process where event.type == "start" and process.name : "chrome.exe"]
  [process where event.type == "end" and process.name : "chrome.exe" and
   process.exit_code != 0]

Splunk SPL Query

index=endpoint (process_name=chrome.exe OR process_name="chrome")
| where (like(process, "%--no-sandbox%") OR like(process, "%--disable-web-security%"))
| stats count by host, user, process, _time
| where count > 0
| table _time, host, user, process, count

Wazuh OSSEC Rule

<group name="chrome,cve-2026-106358,">
  <rule id="100358" level="10">
    <if_sid>92000</if_sid>
    <field name="win.eventdata.image">chrome.exe</field>
    <field name="win.eventdata.commandLine">--no-sandbox|--disable-web-security</field>
    <description>CVE-2026-106358: Suspicious Chrome invocation consistent with Navigation use-after-free exploitation</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Enforce automatic updates in Chrome and confirm fleet-wide version reporting; treat any endpoint below 155.0.8059.39 as exposed.
   • Prioritize browser updates over lower-risk patching backlog given Critical severity and network-deliverable attack surface.
   • Deploy network and endpoint detection for the telemetry described above; alert on abnormal Chromium renderer process terminations.
   • Restrict execution of untrusted HTML delivery vectors where feasible (block known malvertising domains, enforce secure web gateways).
   • Apply exploit mitigations (ASLR, CFG, ACG) at the OS level; these raise the bar for sandbox-escape primitives even when the underlying bug is unpatched.

2. Patch / upgrade steps.

   • Update Google Chrome to version 155.0.8059.39 or later on all managed endpoints, including VDI base images, golden images, and kiosks.
   • Verify the applied version post-update (chrome://version) and re-scan to confirm no stragglers remain.
   • For Chromium-based derivatives (Edge, Brave, Opera), track the corresponding upstream Chromium backport and patch on the vendor's timeline.

3. Long-term hardening.

   • Enforce a maximum browser-version-drift policy with automated compliance reporting.
   • Segment high-value endpoints and require privileged access workstations for sensitive roles to reduce blast radius of a client-side compromise.
   • Maintain threat-hunting coverage tuned to Chromium memory-corruption exploitation patterns (heap spray, JIT anomalies, unexpected child processes from renderers).

References

• NVD — CVE-2026-106358: https://nvd.nist.gov/vuln/detail/CVE-2026-106358
• CWE-416 Use After Free: https://cwe.mitre.org/data/definitions/416.html
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• Google Chrome Release Notes / Stable Channel updates: https://chromereleases.googleblog.com/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (not currently listed as of this report)