CVE-2026-106278

Analyzed Analyzed - Analysis Complete

Use After Free in Select in Google Chrome

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: Chrome

Description

Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106278

EUVD

EUVD-2026-93835

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 155.0.8059.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free issue in the Select component of Google Chrome before version 155.0.8059.39. A use-after-free occurs when a program continues to use memory after it has been freed, potentially leading to arbitrary code execution. An attacker could exploit this by tricking a user into visiting a specially crafted HTML page, enabling code execution within the browser's sandbox.

Detection Guidance

Detection of this vulnerability requires checking the installed version of Google Chrome. If your version is prior to 155.0.8059.39, the system is vulnerable. Use commands like 'google-chrome --version' or check via package manager (e.g., 'apt list --installed | grep chrome' for Debian-based systems).

No direct network detection commands are provided for this specific vulnerability. Focus on verifying Chrome versions across systems.

Impact Analysis

This vulnerability could allow a remote attacker to execute arbitrary code on your system if you visit a malicious webpage. Since it exploits a use-after-free in Chrome's Select component, it may bypass sandbox protections, potentially compromising your data or system. Social engineering is required, meaning the attacker must trick you into visiting the crafted page.

Compliance Impact

This vulnerability could potentially lead to unauthorized code execution, which may result in data breaches or unauthorized access to sensitive information. Such incidents could violate compliance requirements under GDPR, HIPAA, or other regulations by exposing personal or health data without consent or proper safeguards.

Mitigation Strategies

Update Google Chrome to version 155.0.8059.39 or later to address the use-after-free vulnerability in Select.

Hi! I’m here to help you understand CVE-2026-106278. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70