PatchGap
Chrome · Navigation

CVE-2026-106358

UAF in Navigation
Critical chrome UAF 🔧 Commit mapped

Overview

Critical
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in Navigation
DescriptionUse after free in Navigation
ComponentNavigation
Bug ClassUAF
Tracker567160164
Fix commit9be2ecbb64ea (chromium/src) +88/-3
CISA KEVNot listed
CreditedXinyang Ge (Anthropic), assisted by Claude
Disclosed2026-10-06

Files Changed

  • content/browser/renderer_host/render_frame_host_manager.cc
  • content/browser/renderer_host/render_view_host_impl.cc
  • content/browser/renderer_host/render_frame_host_manager_unittest.cc

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page