CVE-2026-106293
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Type confusion vulnerability in the ANGLE component of Google Chrome prior to version 155.0.8059.39. A remote attacker who had compromised the renderer process could potentially execute arbitrary code outside the sandbox via a crafted HTML page.
Risk Assessment
An attacker could exploit this flaw to escape the sandbox and execute code on the system, potentially leading to full device compromise. The high severity requires immediate action.
Recommendation
Immediately update Google Chrome to version 155.0.8059.39 or later. Consider deploying additional security layers such as browser isolation.
Other vulnerabilities in Google Chrome
See all- CVE-2026-120930Unknown
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium rates this as High severity.
- CVE-2026-121257Unknown
Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)
- CVE-2026-121256High
Use of a released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
- CVE-2026-121255Unknown
Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.
- CVE-2026-121254Unknown
Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page.
- CVE-2026-121253Unknown
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension.
- CVE-2026-121252Unknown
Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.
- CVE-2026-121251Unknown
Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.
- CVE-2026-121250Unknown
Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension.
- CVE-2026-121248Unknown
Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension.
Original NVD description (English source)
Type confusion in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS