Google Chrome CVE-2026-106247

Exploitation requires that the attacker has ALREADY compromised Chrome's sandboxed renderer process via a separate vulnerability - this CVE is a sandbox-escape/second-stage primitive in the ANGLE graphics layer (CWE-122 heap overflow), not an initial-access bug. Beyond that precondition, the victim must load a crafted HTML page (UI:R, active user interaction), and the exploit must reliably corrupt ANGLE heap memory (reflected by AC:H). Limiting factors: dependence on a working renderer-exploit chain, required user interaction, and the fact that fully patched builds (>=155.0.8059.39) are not affected. Affected: Google Chrome versions prior to 155.0.8059.39.

Signals conflict sharply and must be reconciled. The provided CVSS 3.1 base score is 8.3 (High) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, driven largely by the scope change (S:C) that reflects a sandbox escape. However, Google/Chromium rates the security severity as 'Low', and the description makes the reason explicit: the flaw is only reachable by 'a remote attacker who had compromised the renderer process' - i.e., it is a second-stage sandbox-escape primitive, not independently exploitable. The CVSS vector's PR:N is therefore misleading: no Chrome privileges are needed, but a prior renderer compromise (a separate vulnerability) is a hard precondition, which the AC:H rating only partially captures. CISA SSVC reinforces lower urgency: Exploitation=none, Automatable=no, Technical Impact=total. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed to be actively exploited. EPSS is not provided in the input and cannot be assessed. Net: despite the 8.3 score, real-world priority is moderate-to-low for most defenders - it is dangerous only as part of an exploit chain, and the honest read is a high-CVSS-but-chain-dependent issue rather than a standalone emergency. Standard priority is simply to deploy the Chrome stable update to 155.0.8059.39.

An attacker who has already achieved code execution inside Chrome's sandboxed renderer (via a separate renderer bug) lures a victim to a crafted HTML page that drives ANGLE into a heap buffer overflow. Successful exploitation corrupts memory to break out of the sandbox and run arbitrary code on the host with the browser process's privileges. No public exploit identified at time of analysis, and the attack requires both prior renderer compromise and user interaction (loading the page).