CVE-2026-106273: Google Chrome Video Information Disclosure

CVE-2026-106273 Overview

CVE-2026-106273 is an uninitialized memory use vulnerability [CWE-908] in the Video component of Google Chrome versions prior to 155.0.8059.39. A remote attacker who has already compromised the renderer process can read memory outside the sandbox by serving a crafted HTML page. The flaw does not grant code execution on its own, but it provides an information disclosure primitive that can accelerate sandbox escape chains. Google rates the Chromium security severity as High, while the NVD CVSS v3.1 score is 4.7 due to the required precondition of a compromised renderer and the limited confidentiality impact.

Critical Impact
An attacker with a foothold in the Chrome renderer process can leak memory contents across the sandbox boundary, aiding further exploitation of the browser.

Affected Products

Google Chrome Desktop versions prior to 155.0.8059.39
Chromium-based browsers that embed vulnerable Video component code
All supported desktop platforms (Windows, macOS, Linux) running affected Chrome builds

Discovery Timeline

2026-10-06 - CVE-2026-106273 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106273

Vulnerability Analysis

The vulnerability resides in Chrome's Video component, where a resource is used before being fully initialized. When the renderer processes a crafted HTML page referencing specific video content, the uninitialized resource is read and its contents become observable to attacker-controlled code running in the renderer. Because the uninitialized memory may contain data populated by the browser process or sibling allocations, the attacker gains visibility into bytes that should remain outside the sandbox. Exploitation requires that the attacker has already achieved code execution within the renderer, typically by chaining a prior renderer compromise. The resulting disclosure can be used to defeat Address Space Layout Randomization (ASLR) or recover sensitive data from adjacent memory regions.

Root Cause

The root cause is classified under [CWE-908: Use of Uninitialized Resource]. The Video code path allocates a buffer or object without zeroing or populating its contents before exposing it to downstream consumers. Subsequent reads return stale heap data, which may originate from previous allocations or privileged browser operations. The condition is tracked in Chromium Issue Tracker #553118338.

Attack Vector

The attack requires network delivery of a crafted HTML page and user interaction to load the page in the browser. The attacker must already control the renderer process. Once the crafted content triggers the vulnerable Video code path, the renderer reads memory that crosses the sandbox boundary, violating the renderer's isolation guarantees. No elevated privileges are required beyond the compromised renderer context.

No verified public exploit code is available. Refer to the Google Chrome Stable Update and the Chromium issue tracker for technical details.

Detection Methods for CVE-2026-106273

Indicators of Compromise

Chrome renderer processes exhibiting abnormal child process crashes or heap corruption telemetry preceding information disclosure attempts.
Browser clients still reporting a User-Agent version string below Chrome/155.0.8059.39 after the patch window.
Outbound connections from endpoints to recently registered domains serving crafted HTML and video resources.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build older than 155.0.8059.39.
Monitor renderer process telemetry for anomalous memory read patterns, repeated video decoder faults, or unexpected sandbox policy violations.
Correlate web proxy logs with endpoint telemetry to identify sessions where crafted HTML pages precede browser instability.

Monitoring Recommendations

Enable centralized Chrome version reporting through enterprise policy and alert on drift from the fixed baseline.
Ingest browser crash reports and renderer sandbox events into the SIEM for longitudinal analysis.
Track EPSS and vendor advisory updates for CVE-2026-106273 since Chromium rates the underlying bug as High severity.

How to Mitigate CVE-2026-106273

Immediate Actions Required

Update Google Chrome to version 155.0.8059.39 or later on all desktop endpoints.
Force a browser restart after the update to ensure the patched binaries are loaded.
Audit Chromium-based third-party browsers and embedded WebViews for an equivalent upstream merge.

Patch Information

Google released the fix in the Chrome Stable Channel update documented in the Google Chrome Stable Update advisory. The patched version is 155.0.8059.39. Enterprises using managed deployments should push the update through Chrome Browser Cloud Management, Group Policy, or their endpoint management platform.

Workarounds

No vendor-supplied workaround exists; apply the stable channel update as the primary remediation.
Restrict browsing to trusted sites via enterprise URL allowlists until patching completes on all endpoints.
Consider disabling autoplay and preloading of untrusted video content through enterprise Chrome policies as a defense-in-depth measure.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Example Windows Group Policy registry value forcing auto-update
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f