CVE-2026-106200 in Chrome
Summary
by MITRE • 10/06/2026
Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified as a use-after-free flaw within the Track component of Google Chrome prior to version 155.0.8059.39 represents a critical memory corruption issue that undermines the browser's sandboxing mechanisms. This type of error occurs when an application continues to use a pointer after it has been freed, leading to undefined behavior that can be exploited by malicious actors. In this specific instance, the flaw resides in how Chrome handles object lifecycle management within its Track subsystem, which is likely involved in tracking user interactions or media playback states. When memory allocated for these objects is deallocated but references to them remain active and accessible through other parts of the codebase, an attacker can manipulate the state of freed memory to execute arbitrary commands.
The operational impact of this vulnerability is severe due to its potential for remote code execution via a crafted HTML page. An attacker does not need physical access or user interaction beyond visiting a maliciously designed website. By embedding specific exploit code within an HTML file, the attacker can trigger the use-after-free condition during normal browsing activities such as loading media content or interacting with web elements that utilize the Track component. This allows the execution of arbitrary code inside the browser's sandbox environment. While Chrome employs multiple layers of security including site isolation and sandboxing to limit the damage from a successful exploit, bypassing these controls through memory corruption techniques remains a primary goal for advanced persistent threats and automated exploitation kits targeting end-users.
From a classification perspective, this vulnerability aligns with CWE-416, which defines use after free as an error where software uses memory after it has been freed. This category of flaws is particularly dangerous because they often lead to code execution or denial of service conditions depending on how the attacker manipulates the heap state post-deallocation. In terms of offensive security frameworks, this exploit path corresponds to ATT&CK technique T1203, which covers exploitation for client execution. The ability to execute arbitrary code via a web page places this vulnerability squarely within the realm of browser-based attacks that leverage memory safety issues to gain initial access or escalate privileges within the user's environment.
Mitigation strategies primarily involve updating Google Chrome to version 155.0.8059.39 or later, where these memory management errors have been corrected by ensuring proper pointer invalidation and lifecycle tracking for objects in the Track component. Organizations should enforce automated update policies across all endpoints running this browser to minimize exposure windows. Additionally, users can reduce risk by enabling sandboxing features strictly and avoiding interaction with untrusted web content until patches are applied. Security teams should monitor for indicators of compromise related to memory corruption exploits and ensure that endpoint detection systems are configured to flag unusual heap activity patterns associated with use-after-free attacks.