CVE-2026-106373 in Chrome
Summary
by MITRE • 10/07/2026
Use after free in Fonts in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability described involves a use-after-free error within the font handling subsystem of Google Chrome on Windows, specifically affecting versions prior to 155.0.8059.39. This class of memory corruption bug occurs when a program continues to use a pointer after the memory it points to has been freed and potentially reallocated for another purpose. In this specific instance, the flaw resides in how Chrome processes font data during rendering operations. When an attacker crafts a malicious HTML page that triggers complex or malformed font loading sequences, they can manipulate the timing of memory deallocation relative to subsequent access attempts. By carefully controlling the state of the browser's internal objects and ensuring that freed memory is accessed before it is either reclaimed by the system or overwritten with new data, the attacker gains an opportunity to corrupt critical control structures within the application’s execution context.
From a technical perspective, this vulnerability maps directly to CWE-416, which defines use-after-free as a condition where software uses memory after it has been freed. The operational impact of such a flaw is severe because it allows for arbitrary code execution with potentially elevated privileges relative to the initial attack vector. Although Chrome employs sandboxing mechanisms designed to limit the damage an attacker can cause if they successfully exploit a vulnerability, use-after-free bugs are particularly dangerous in this context. They often allow attackers to bypass these sandboxes by manipulating object headers or function pointers within the heap structure. Once control over execution flow is established through memory corruption, the malicious payload can execute arbitrary commands on the host system, effectively breaking out of the restricted browser environment and gaining access to sensitive user data, files, or network resources that would otherwise be protected.
The attack vector for this vulnerability is classified as remote, meaning it does not require any physical interaction with the victim's machine beyond viewing a malicious webpage. This significantly increases its potential impact in real-world scenarios where attackers distribute exploit kits via phishing emails, compromised websites, or drive-by download schemes. The Chromium security team has categorized this issue with a medium severity rating, reflecting both the complexity required to reliably trigger the condition and the significant risk posed by successful exploitation within the browser environment. Mitigation strategies primarily involve updating Google Chrome to version 155.0.8059.39 or later, where the underlying memory management logic for font processing has been corrected to prevent access to freed memory regions. Additionally, users should ensure that their operating system and other software components are up to date to maintain robust defense-in-depth measures against potential exploitation attempts targeting browser vulnerabilities.