CVE-2026-106320

Analyzed Analyzed - Analysis Complete

Use of Released Resource in UI in Google Chrome

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: Chrome

Description

Use of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106320

EUVD

EUVD-2026-93640

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 155.0.8059.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-672	The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in Google Chrome before version 155.0.8059.39 where a compromised renderer process could exploit a released resource in the UI to spoof UI elements. This means an attacker could trick users into seeing fake or misleading interface elements via a crafted HTML page.

Detection Guidance

This vulnerability involves UI spoofing in Google Chrome due to improper handling of released resources. Detection requires checking the Chrome version and monitoring for suspicious UI behavior. No specific commands are provided in the available context.

Impact Analysis

An attacker could deceive you into interacting with fake UI elements, potentially leading to unintended actions like submitting sensitive data or downloading malicious content. This could result in phishing attacks or unauthorized access to your system.

Compliance Impact

This vulnerability involves UI spoofing in Google Chrome due to improper handling of released resources. While it does not directly impact data security or privacy, it could potentially be used to deceive users into disclosing sensitive information, which may indirectly affect compliance with standards like GDPR or HIPAA by enabling phishing attacks.

Mitigation Strategies

Update Google Chrome to version 155.0.8059.39 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-106320. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70