Google Chrome CVE-2026-106238

Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process (via a separate, prior vulnerability) - this is the central, hard prerequisite stated directly in the description, not a theoretical limit. Given that foothold, the attacker delivers a crafted HTML page that triggers a race condition in Chrome's Fonts handling (CWE-362) to escape the sandbox. Additional limiting factors: the CVSS vector sets UI:R, so the victim must load attacker-controlled content, and AC:H reflects the non-deterministic nature of winning the race, making reliable exploitation difficult. Affected: Google Chrome before 155.0.8059.39; updating to 155.0.8059.39 or later removes the condition.

Signals here are deliberately mixed and must be read together. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) yields a high 8.3 and reflects a scope-changing sandbox escape with total confidentiality, integrity and availability impact. However, the description makes the true precondition explicit: the attacker must have ALREADY compromised the renderer process before this race condition can be abused to escape the sandbox - so despite PR:N in the vector, this is realistically the second link in an exploit chain, not a standalone remote compromise. This tension (CVSS PR:N vs. description requiring a pre-compromised renderer) should be noted when prioritizing. The SSVC framework confirms the lower real-world urgency: Exploitation=none, Automatable=no, Technical Impact=total - i.e., severe if exploited but not currently exploited and not easily automated, consistent with the AC:H (race condition) rating. There is no CISA KEV listing and no public exploit identified at time of analysis; Google rated the Chromium severity only Medium. Net assessment: a genuinely serious sandbox-escape primitive in an ubiquitous product, but NOT an immediate drop-everything emergency on its own - priority is driven by patch hygiene across the Chrome fleet rather than by evidence of active exploitation. Patch promptly as part of routine Chrome update cadence.

An attacker first compromises the Chrome renderer process through a separate vulnerability (e.g., a prior RCE triggered when the victim visits a malicious site), then serves a crafted HTML page that drives the font-handling code into a race condition. Winning the race lets the attacker-controlled renderer execute arbitrary code outside the sandbox on the host. No public exploit code has been identified at time of analysis, and the AC:H rating reflects the difficulty of reliably winning the race.