{"id":"CVE-2026-106417","published":"2026-10-06T19:18:11Z","modified":"2026-10-07T13:10:43Z","title":"Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute…","vendor":"Google","product":"Chrome","tier":"core","eol":null,"description":{"text":"Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","provenance":"source","from":"NVD"},"summary":{"text":"Google Chrome prior to 155.0.8059.39 contains an integer overflow in its Media component. The flaw is an integer overflow in the Media component of Google Chrome. An attacker who can get a user to load a crafted HTML page can potentially execute arbitrary code outside the browser sandbox, which requires user interaction (the victim visiting the page) and remote network delivery of the page, with no prior authentication needed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:20:24Z"},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00338,"percentile":0.2722,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | Oct 15, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6acf98726e4260f2f2ba3d49","created":"2026-10-14"},{"name":"Known_Cve | Oct 14, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ace466c18a71dd7afa3f788","created":"2026-10-13"},{"name":"Known_Cve | Oct 13, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6accf723f346ce4b8a50d55a","created":"2026-10-12"},{"name":"Known_Cve | Oct 12, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6acba8a68a86c4d9508005a7","created":"2026-10-11"},{"name":"Known_Cve | Oct 11, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6aca554665c47eb24716f8f2","created":"2026-10-10"},{"name":"Known_Cve | Oct 10, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac90361476f45b4b982597d","created":"2026-10-09"},{"name":"Known_Cve | Oct 9, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac7b1a3f215e7af4290dc2e","created":"2026-10-08"},{"name":"Known_Cve | Oct 8, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac65e5b607642608f852c9a","created":"2026-10-07"}],"provenance":"machine"},"cwes":[{"id":"CWE-190","name":"Integer Overflow or Wraparound"}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/536471438","tags":["Permissions Required"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-93619","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93619","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-06","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106417","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":14.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":5.44,"detail":"percentile 0.2722"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":6.72,"detail":"base score 9.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-google-chrome-cwe-190"}}