CVE-2026-106347

CVE-2026-106347 is a use-after-free (CWE-416) in the Track component of Google Chrome before version 155.0.8059.39. A remote attacker can trigger it by convincing a user to open a crafted HTML page, with no prior privileges required. Successful exploitation allows arbitrary code execution inside the Chrome sandbox (CVSS 3.1 8.8, Chromium severity Critical), but not necessarily escape from the sandbox. Everyone running a Chrome build older than 155.0.8059.39 is affected. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Update Google Chrome to version 155.0.8059.39 or later on all devices and let auto-update finish before browsing untrusted sites. Until then, avoid opening unexpected HTML pages or links. Enterprise admins should confirm the fixed build is deployed and that older Chrome versions are no longer in use.