CVE-2026-106298: Use after free in Chrome Tabs
Published Sep 2, 2026
·Updated
Use after free in Chrome Tabs in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Credit
TIENPA
Affected Software
3 affected componentsFixes available
Google Chrome<155.0.8059.39
155.0.8059.39
All of the following
Google Chrome<155.0.8059.39
Apple macOS
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 155.0.8059.39
Event History
Sep 2, 2026
CVE Published
12:00 AM
Data Sourced
12:00 AM
SeverityWeaknessAffected Software
Oct 6, 2026
CVE Published
via MITRE·06:41 PM
Data Sourced
via MITRE·06:41 PM
DescriptionWeakness
Data Sourced
via NVD·07:17 PM
DescriptionSeverityWeaknessAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-106382
- CVE-2026-106197
- CVE-2026-106358
- CVE-2026-106347
- CVE-2026-102322
- CVE-2026-106245
- CVE-2026-106327
- CVE-2026-106366
- CVE-2026-106258
- CVE-2026-106376
- CVE-2026-106308
- CVE-2026-106215
- CVE-2026-106369
- CVE-2026-106293
- CVE-2026-106377
- CVE-2026-106412
- CVE-2026-106243
- CVE-2026-106214
- CVE-2026-106364
- CVE-2026-106239
- CVE-2026-106426
- CVE-2026-106419
- CVE-2026-106396
- CVE-2026-106323
- CVE-2026-106231
- CVE-2026-106202
- CVE-2026-106273
- CVE-2026-106203
- CVE-2026-106332
- CVE-2026-106281
- CVE-2026-106193
- CVE-2026-106255
- CVE-2026-106393
- CVE-2026-106227
- CVE-2026-106379
- CVE-2026-106211
- CVE-2026-106329
- CVE-2026-106248
- CVE-2026-106235
- CVE-2026-106257
- CVE-2026-106268
- CVE-2026-106278
- CVE-2026-106233
- CVE-2026-106318
- CVE-2026-106411
- CVE-2026-106423
- CVE-2026-106346
- CVE-2026-106190
- CVE-2026-106357
- CVE-2026-106240
- CVE-2026-106184
- CVE-2026-106383
- CVE-2026-106349
- CVE-2026-106421
- CVE-2026-106204
- CVE-2026-106200
- CVE-2026-106265
- CVE-2026-106238
- CVE-2026-106324
- CVE-2026-106420
- CVE-2026-106222
- CVE-2026-106208
- CVE-2026-106286
- CVE-2026-106181
- CVE-2026-106315
- CVE-2026-106274
- CVE-2026-106365
- CVE-2026-106267
- CVE-2026-106194
- CVE-2026-106313
- CVE-2026-106283
- CVE-2026-106291
- CVE-2026-106300
- CVE-2026-106314
- CVE-2026-106223
- CVE-2026-106242
- CVE-2026-106241
- CVE-2026-106381
- CVE-2026-106217
- CVE-2026-106425
- CVE-2026-106225
- CVE-2026-106363
- CVE-2026-106266
- CVE-2026-106189
- CVE-2026-106335
- CVE-2026-106415
- CVE-2026-106224
- CVE-2026-106185
- CVE-2026-106244
- CVE-2026-106407
- CVE-2026-106389
- CVE-2026-106397
- CVE-2026-106196
- CVE-2026-106414
- CVE-2026-106408
- CVE-2026-106261
- CVE-2026-106406
- CVE-2026-106290
- CVE-2026-106378
- CVE-2026-106198
- CVE-2026-106326
- CVE-2026-106354
- CVE-2026-106342
- CVE-2026-106424
- CVE-2026-106253
- CVE-2026-106279
- CVE-2026-106361
- CVE-2026-106402
- CVE-2026-106311
- CVE-2026-106246
- CVE-2026-106302
- CVE-2026-106416
- CVE-2026-106182
- CVE-2026-106282
- CVE-2026-106392
- CVE-2026-106188
- CVE-2026-106370
- CVE-2026-106356
- CVE-2026-106405
- CVE-2026-106322
- CVE-2026-106280
- CVE-2026-106206
- CVE-2026-106180
- CVE-2026-106303
- CVE-2026-106201
- CVE-2026-106333
- CVE-2026-106228
- CVE-2026-106289
- CVE-2026-106277
- CVE-2026-106410
- CVE-2026-106284
- CVE-2026-106209
- CVE-2026-106216
- CVE-2026-106328
- CVE-2026-106387
- CVE-2026-106400
- CVE-2026-106205
- CVE-2026-106213
- CVE-2026-106230
- CVE-2026-106367
- CVE-2026-106226
- CVE-2026-106229
- CVE-2026-106232
- CVE-2026-106391
- CVE-2026-106336
- CVE-2026-106403
- CVE-2026-106373
- CVE-2026-106301
- CVE-2026-106292
- CVE-2026-106262
- CVE-2026-106360
- CVE-2026-106375
- CVE-2026-106348
- CVE-2026-106307
- CVE-2026-106212
- CVE-2026-106398
- CVE-2026-106388
- CVE-2026-106271
- CVE-2026-106395
- CVE-2026-106304
- CVE-2026-106401
- CVE-2026-106330
- CVE-2026-106295
- CVE-2026-106352
- CVE-2026-106337
- CVE-2026-106263
- CVE-2026-106404
- CVE-2026-106183
- CVE-2026-106386
- CVE-2026-106351
- CVE-2026-106384
- CVE-2026-106207
- CVE-2026-106321
- CVE-2026-106210
- CVE-2026-106254
- CVE-2026-106372
- CVE-2026-106341
- CVE-2026-106409
- CVE-2026-106340
- CVE-2026-106276
- CVE-2026-106338
- CVE-2026-106317
- CVE-2026-106344
- CVE-2026-106359
- CVE-2026-106353
- CVE-2026-106312
- CVE-2026-106191
- CVE-2026-106250
- CVE-2026-106309
- CVE-2026-106187
- CVE-2026-106394
- CVE-2026-106306
- CVE-2026-106427
- CVE-2026-106252
- CVE-2026-106287
- CVE-2026-106297
- CVE-2026-106260
- CVE-2026-106362
- CVE-2026-106275
- CVE-2026-106199
- CVE-2026-106299
- CVE-2026-106422
- CVE-2026-106186
- CVE-2026-106247
- CVE-2026-106192
- CVE-2026-106399
- CVE-2026-106264
- CVE-2026-106285
- CVE-2026-106220
- CVE-2026-106417
- CVE-2026-106221
- CVE-2026-106259
- CVE-2026-106296
- CVE-2026-106249
- CVE-2026-106374
- CVE-2026-106380
- CVE-2026-106179
- CVE-2026-106368
- CVE-2026-106237
- CVE-2026-106331
- CVE-2026-106270
- CVE-2026-106350
- CVE-2026-106288
- CVE-2026-106305
- CVE-2026-106418
- CVE-2026-106343
- CVE-2026-106371
- CVE-2026-106256
- CVE-2026-106413
- CVE-2026-106339
- CVE-2026-106320
- CVE-2026-106195
- CVE-2026-106316
- CVE-2026-106385
- CVE-2026-106325
- CVE-2026-106390
- CVE-2026-106294
- CVE-2026-106334
- CVE-2026-106236
- CVE-2026-106251
- CVE-2026-106310
- CVE-2026-106345
- CVE-2026-106272
- CVE-2026-106355
- CVE-2026-106234
- CVE-2026-106269
Frequently Asked Questions
1
Which systems are affected?
The issue affects Google Chrome on Mac versions earlier than 155.0.8059.39.
2
What does exploitation require?
An attacker can target a user remotely with a crafted HTML page. The CVSS vector indicates no attacker privileges are required, but user interaction is required.
3
How can I determine whether a system is affected?
Check the installed Google Chrome version on Mac. Versions prior to 155.0.8059.39 are affected.