Google Chrome CVE-2026-106201

Exploitation requires an attacker-controlled web page: the victim must actively navigate a vulnerable Chrome build (before 155.0.8059.39) to attacker-supplied HTML that drives the V8 JavaScript engine into the race condition (UI:R in the vector). Key limiting factors: (1) required user interaction (the victim must open the page); (2) impact is confined 'inside the sandbox' per the description, so successful exploitation yields code execution only within the renderer/V8 sandbox and does NOT by itself compromise the host - a separate sandbox escape is needed; (3) as a race condition (CWE-362), triggering may be timing-sensitive and not fully deterministic despite the vendor's AC:L rating; (4) only unpatched versions below 155.0.8059.39 are affected.

Signals are mixed but lean toward meaningful risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, unauthenticated bug requiring only that a victim open a crafted page, which is trivial to arrange via phishing or malvertising. However, three signals temper this: (1) Chromium rated the security severity 'Medium', not high/critical, and the description explicitly states code execution is 'inside the sandbox' - i.e. within the renderer/V8 sandbox, NOT a full host compromise, so a separate sandbox-escape bug would be needed for real-world RCE on the OS; (2) CISA's SSVC framework reports Exploitation: none and Automatable: no, arguing against active or mass exploitation despite 'Technical Impact: total'; (3) no EPSS score, no KEV listing, and no public POC were provided. There is also a notable internal tension: this is a CWE-362 race condition, which typically implies timing-dependent, non-deterministic triggering (usually AC:H), yet the vendor assigned AC:L - treat exploitation reliability as unconfirmed and verify against the vendor bug tracker. Net: a patch-promptly browser issue, not an emergency, because impact is sandbox-confined and no exploitation is observed.

An attacker hosts or injects a malicious HTML page that drives V8 into the race condition; a victim running a vulnerable Chrome (<155.0.8059.39) visits the page and the attacker achieves arbitrary code execution confined to the renderer/V8 sandbox. No public exploit code was identified at time of analysis, and because execution is sandbox-bound, a full host takeover would require chaining an additional sandbox-escape vulnerability.