CVE-2026-106310: Google Chrome FontAccess Auth Bypass Flaw

CVE-2026-106310 Overview

CVE-2026-106310 is a use-of-released-resource vulnerability in the FontAccess component of Google Chrome prior to version 155.0.8059.39. A remote attacker who has already compromised the renderer process can bypass the web origin policy by serving a crafted HTML page. The flaw is tracked under CWE-672: Operation on a Resource after Expiration or Release and is categorized by Chromium as low severity. Google addressed the issue in the stable channel desktop update published in October 2026.

Critical Impact
Successful exploitation enables cross-origin data access from a compromised renderer, undermining the same-origin boundary that isolates web content.

Affected Products

Google Chrome Desktop versions prior to 155.0.8059.39
Chromium-based browsers sharing the vulnerable FontAccess implementation
All supported desktop platforms (Windows, macOS, Linux)

Discovery Timeline

2026-10-06 - CVE-2026-106310 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106310

Vulnerability Analysis

The vulnerability resides in the FontAccess API implementation inside Chrome's renderer process. The code continues to operate on a font resource after it has been released, satisfying the [CWE-672] pattern of using a resource past its valid lifetime. An attacker who has already compromised the renderer process can leverage this behavior through a crafted HTML page to reach memory or state that should no longer be reachable. The outcome is a bypass of the web origin policy, allowing the attacker to read or influence data belonging to other origins loaded in the same browser context. The EPSS score is 0.311%, reflecting low near-term exploitation probability.

Root Cause

The root cause is improper lifetime management of a font-related object exposed through the FontAccess interface. The renderer retains or re-uses a reference to a released resource rather than invalidating it, enabling subsequent operations on freed state.

Attack Vector

Exploitation requires an attacker to first compromise the renderer process through a separate flaw. The attacker then delivers a crafted HTML page that triggers the released-resource condition in FontAccess. User interaction, such as visiting a malicious page, is required. The result is a cross-origin policy bypass rather than direct code execution. See Chromium Issue #556250086 for upstream tracking.

Detection Methods for CVE-2026-106310

Indicators of Compromise

Chrome processes running versions earlier than 155.0.8059.39 after the October 2026 patch window
Unexpected renderer crashes referencing FontAccess or font-table operations
Cross-origin data access patterns in web telemetry that lack a corresponding user-initiated navigation

Detection Strategies

Inventory browser versions across managed endpoints and flag Chrome installations below 155.0.8059.39
Correlate renderer crash dumps with browsing activity to identify suspicious font-related exceptions
Monitor outbound requests from browser sessions for exfiltration patterns following page loads on untrusted origins

Monitoring Recommendations

Enable browser management policies that report installed versions to a central console
Forward endpoint browser telemetry to a SIEM for version compliance reporting
Alert on repeated renderer process restarts tied to specific domains

How to Mitigate CVE-2026-106310

Immediate Actions Required

Update Google Chrome to version 155.0.8059.39 or later on all desktop endpoints
Restart browser sessions after patching to ensure the vulnerable renderer code is unloaded
Validate Chromium-based third-party browsers for vendor patches incorporating the upstream fix

Patch Information

Google released the fix in the stable channel desktop update documented in the Chrome Desktop Update - October 2026 advisory. Administrators should deploy version 155.0.8059.39 or higher through enterprise update channels.

Workarounds

Restrict browsing to trusted sites until patch deployment completes
Disable or constrain the FontAccess API through enterprise policy where feasible
Enforce site isolation to limit the blast radius of a compromised renderer

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Windows registry policy to enforce automatic Chrome updates
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f