First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2026-106416

MediumCVSS 5.4/10Last modified Oct 7, 2026

Description

Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Weakness enumeration

Affected software

Vendor	Product	Versions
Google	Chrome	>= 155.0.8059.39, < 155.0.8059.39

References

https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.htmlRelease Notes, Vendor Advisory
https://issues.chromium.org/issues/514072462Permissions Required

Timeline

Published: Oct 6, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1064179.6Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside th CVE-2026-1064186.5Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass w CVE-2026-1064199.6Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside th CVE-2026-106424.6The Zephyr PL011 UART driver (drivers/serial/uart_pl011.c) contains an unbounded software loop in pl011_irq_tx_enable() that repeatedly invo CVE-2026-1064205.4Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering t CVE-2026-1064218.8Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a c CVE-2026-1064224.3Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted H CVE-2026-1064238.8Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a CVE-2026-1064244.0Information leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read CVE-2026-1064254.2Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer proce CVE-2026-1064268.3Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the CVE-2026-1064275.4Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions i