Google Chrome CVE-2026-106207

Exploitation requires the victim to open a crafted HTML page in a vulnerable Chrome build prior to 155.0.8059.39 (UI:R - user interaction via page load). No authentication or prior privileges are needed (PR:N). As a CWE-367 race condition, success also depends on the attacker winning a time-of-check/time-of-use timing window in V8, which reduces reliability. A critical limiting factor is that the achieved code execution is confined to the Chrome renderer sandbox - the vulnerability alone does NOT escape the sandbox or compromise the host OS, so meaningful system-level impact additionally requires chaining a separate sandbox-escape bug. Default Chrome configurations are affected; no special product feature or non-default setting is called out in the description.

This is a genuine but second-tier priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) depicts a network-reachable, unauthenticated flaw needing only that a victim load a crafted HTML page - a classic drive-by profile. However, two signals temper the raw score: (1) the description explicitly states code execution occurs INSIDE the Chrome sandbox, meaning this alone does not yield host compromise and would need to be chained with a sandbox escape for full impact; and (2) CWE-367 (TOCTOU race condition) realistically implies attacker control over a timing window, which argues for higher attack complexity than the AC:L the vendor assigned. Chromium itself rated the severity only 'Medium.' The SSVC framework aligns with a non-emergency posture: Exploitation=none, Automatable=no, Technical Impact=total - i.e., no observed exploitation and not amenable to mass automation, though full technical impact if triggered. No KEV listing and no POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' EPSS is MISSING from the provided data and cannot be cited. Net: patch promptly as part of normal Chrome update cadence, but this is not a confirmed zero-day requiring emergency out-of-band action.

An attacker hosts a malicious web page (or injects malicious script into a compromised/ad-served page) and lures a victim into visiting it with a vulnerable Chrome build prior to 155.0.8059.39. The crafted page drives V8 into a time-of-check/time-of-use race, achieving arbitrary code execution within the renderer sandbox; given UI:R and the race condition (CWE-367), success depends on the victim loading the page and the attacker winning a timing window, and full host compromise would require chaining an additional sandbox escape. No public exploit code is identified in the provided data.