CVE-2026-106234: Google Chrome Use After Free Vulnerability

CVE-2026-106234 Overview

CVE-2026-106234 is a use-after-free vulnerability in the Network component of Google Chrome prior to version 155.0.8059.39. A remote attacker can leverage social engineering to trick a user into installing a crafted Chrome extension, which can trigger memory corruption and potentially execute arbitrary code outside the browser sandbox. The flaw is tracked under CWE-416: Use After Free. While Chromium rates the internal security severity as Low, the National Vulnerability Database scores it as critical due to the sandbox escape potential.

Critical Impact
Successful exploitation allows arbitrary code execution outside the Chrome sandbox, giving an attacker the ability to run code with the privileges of the browser process on the victim's host.

Affected Products

Google Chrome versions prior to 155.0.8059.39 (Desktop Stable channel)
Chromium-based browsers sharing the affected Network component
All supported desktop platforms (Windows, macOS, Linux)

Discovery Timeline

2026-10-06 - CVE-2026-106234 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106234

Vulnerability Analysis

The vulnerability resides in Chrome's Network component and is classified as a use-after-free condition. A use-after-free occurs when the program continues to reference memory that has already been released back to the allocator. An attacker who controls the reclaimed memory region can corrupt object state and redirect execution flow.

In this case, the dangling reference is reachable from code paths exercised by a crafted Chrome extension. Because the Network service historically runs with broader privileges than renderer processes, memory corruption here can be leveraged to escape the renderer sandbox. The attack requires user interaction, since the victim must be convinced to install the malicious extension.

Root Cause

The defect is a lifetime-management error in a Network component object. Code paths release the backing object while another reference remains live and is subsequently dereferenced. The specific object and reproducer are tracked in Chromium Issue 564085088.

Attack Vector

Exploitation follows a three-step pattern. First, the attacker publishes or distributes a malicious extension and uses social engineering to convince a victim to install it. Second, the extension exercises Network component APIs in a sequence that triggers the use-after-free. Third, the attacker reclaims the freed memory with attacker-controlled data to pivot into arbitrary code execution outside the renderer sandbox.

No public proof-of-concept exploit is listed in the enriched data, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-106234

Indicators of Compromise

Installation of Chrome extensions from outside the Chrome Web Store, or sideloaded via developer mode on managed endpoints.
Chrome crash reports referencing the Network service process with heap corruption or UAF signatures.
Child processes spawned by chrome.exe that are inconsistent with normal browser behavior, such as command shells or script interpreters.
Outbound connections from the Chrome Network service to unfamiliar domains shortly after a new extension is installed.

Detection Strategies

Inventory installed browser extensions across the fleet and alert on unapproved extension IDs, publisher mismatches, or extensions with broad host_permissions.
Monitor for Chrome versions below 155.0.8059.39 using endpoint posture telemetry.
Correlate extension install events with subsequent process creation, file writes, and network connections to identify post-exploitation activity.

Monitoring Recommendations

Collect Chrome crash dumps and WER events centrally and triage any Network service crashes.
Enable extension install logging through enterprise policy and forward events to the SIEM.
Track process ancestry for processes spawned from chrome.exe and alert on LOLBins or script hosts.

How to Mitigate CVE-2026-106234

Immediate Actions Required

Update Google Chrome to version 155.0.8059.39 or later on all desktop endpoints.
Restart browser sessions after patching to ensure the vulnerable Network service process is terminated.
Audit installed extensions and remove any that are untrusted, unused, or sideloaded.

Patch Information

Google addressed CVE-2026-106234 in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. Administrators should confirm managed endpoints are on 155.0.8059.39 or newer. Chromium-based browsers that embed the same Network component should apply vendor updates that incorporate the upstream fix.

Workarounds

Enforce an extension allowlist with the ExtensionInstallAllowlist and ExtensionInstallBlocklist Chrome enterprise policies until patching is complete.
Disable developer mode and block sideloading of extensions on managed devices.
Deliver user awareness guidance warning against installing unsolicited extensions distributed through email, chat, or ad links.

bash

# Example Chrome enterprise policy to restrict extensions (Windows registry)
# Block all extensions by default, then allowlist approved IDs
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f

# Verify Chrome version meets or exceeds the fixed build
"%ProgramFiles%\Google\Chrome\Application\chrome.exe" --version