CVE-2026-106235: Google Chrome WebAudio Use After Free

CVE-2026-106235 Overview

CVE-2026-106235 is a use-after-free vulnerability in the WebAudio component of Google Chrome versions prior to 155.0.8059.39. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to load a crafted HTML page. Google has classified the Chromium security severity as High. The flaw is tracked as [CWE-416] (Use After Free) and resides in the audio processing pipeline exposed to web content. Exploitation requires user interaction such as visiting a malicious or compromised website.

Critical Impact
Successful exploitation yields arbitrary code execution within the Chrome renderer sandbox, giving attackers a foothold for further sandbox escape chains and data theft.

Affected Products

Google Chrome versions prior to 155.0.8059.39 (Stable channel, Desktop)
Chromium-based browsers that embed the vulnerable WebAudio implementation
All desktop platforms shipping the affected Chrome build

Discovery Timeline

2026-10-06 - CVE-2026-106235 published to the National Vulnerability Database
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106235

Vulnerability Analysis

The vulnerability is a use-after-free condition in WebAudio, the Chromium subsystem that processes audio graphs created by JavaScript through the Web Audio API. A crafted HTML page can trigger a code path in which an audio object is freed while another reference still holds a pointer to the released memory. Subsequent access to that dangling pointer allows an attacker to influence program control flow and execute arbitrary code inside the renderer process. Because WebAudio is reachable from any origin without special permissions, the attack surface is broad. Technical details are tracked in Chromium Issue #565612897.

Root Cause

The root cause is improper lifetime management of a WebAudio object. Reference counting or ownership tracking fails along a specific code path, letting an object be destroyed while still referenced. Reuse of the freed allocation enables type confusion and attacker-controlled memory writes.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a malicious HTML page that constructs a specific sequence of Web Audio API calls. When a victim visits the page, the renderer triggers the use-after-free, and attacker-supplied JavaScript gains arbitrary code execution confined to the sandboxed renderer process.

No verified public proof-of-concept code is available for CVE-2026-106235. Refer to the Chromium Issue #565612897 tracker for additional technical context as it becomes public.

Detection Methods for CVE-2026-106235

Indicators of Compromise

Chrome renderer process crashes with heap corruption signatures (SIGSEGV, HEAP-USE-AFTER-FREE) tied to the WebAudio module.
Unexpected child process spawning from chrome.exe renderer instances immediately after audio-heavy page loads.
Outbound network connections from Chrome renderer processes to uncommon destinations following visits to untrusted sites.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any instance below 155.0.8059.39.
Monitor browser telemetry and crash reports for WebAudio-related renderer failures that could indicate exploitation attempts.
Correlate web proxy logs with endpoint process telemetry to identify users loading suspicious HTML pages that heavily exercise the Web Audio API.

Monitoring Recommendations

Enable centralized collection of Chrome crash dumps and browser version inventory through enterprise management tooling.
Alert on anomalous process behavior originating from the Chrome renderer, such as file writes to user profile directories or injection into other processes.
Track newly observed domains referenced in browsing telemetry against threat intelligence feeds for drive-by exploit activity.

How to Mitigate CVE-2026-106235

Immediate Actions Required

Update Google Chrome to version 155.0.8059.39 or later on all desktop endpoints without delay.
Restart browser sessions after patch deployment to ensure the vulnerable code is unloaded from memory.
Audit Chromium-based browsers and embedded WebViews in managed applications for the equivalent fixed version.

Patch Information

Google addressed CVE-2026-106235 in the Chrome Stable channel at version 155.0.8059.39. Deployment guidance and release notes are available in the Google Chrome Stable Update announcement. Enterprise administrators should push the update via Chrome Browser Cloud Management, Group Policy, or their standard patch workflow.

Workarounds

Restrict browsing to trusted sites via web filtering until the patch is deployed enterprise-wide.
Disable or block JavaScript on untrusted origins using enterprise policy to prevent Web Audio API access.
Isolate high-risk browsing in a hardened or remote browser environment to contain renderer-level exploitation.

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\WOW6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# macOS version check
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux version check
google-chrome --version