Google Chrome CVE-2026-106255

Exploitation requires the victim to actively load a crafted HTML/JavaScript page in Google Chrome prior to 155.0.8059.39 (UI:R user interaction), so it cannot be triggered against an idle target with no browsing activity. The flaw is a CWE-362 race condition in the V8 engine, meaning successful exploitation depends on winning a non-deterministic timing window, reducing reliability. Critically, resulting code execution is limited to inside the Chrome renderer sandbox (scope unchanged) - escaping to the host OS requires chaining a separate sandbox-escape vulnerability. No authentication is needed (PR:N). The limiting factors are therefore: mandatory user navigation to attacker content, race-timing reliability, and sandbox containment.

Multiple signals align on genuine but conditional priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes network-reachable, unauthenticated exploitation requiring only that a victim visit a crafted HTML page, and C:H/I:H/A:H yields an 8.8 (High) base score. Google/Chromium rated it 'High' severity and the reporter is Chrome's own team. The critical mitigating fact is in the description itself: code execution is confined 'inside the sandbox' (S:U, scope unchanged) - on its own this bug does not escape Chrome's renderer sandbox, so a full host compromise would require chaining a separate sandbox-escape vulnerability. CWE-362 (race condition) also means reliable exploitation depends on winning a timing window, which typically raises practical attack complexity above the AC:L stated in the input vector. No EPSS score, CISA KEV entry, or public POC is present in the supplied data, so this is not confirmed to be actively exploited; it reads as a high-CVSS browser flaw that is a real patching priority given Chrome's footprint, but not an emergency absent a known exploit chain or in-the-wild activity. Note the conflict to verify: the input marks AC:L, yet race-condition bugs generally warrant AC:H - treat exploitation reliability as lower than the 8.8 suggests.

An attacker hosts or compromises a web page containing JavaScript crafted to trigger the V8 race condition, then lures a Chrome user (via link, ad, or malvertising) to visit it. Winning the timing window corrupts V8 memory and lets the attacker run arbitrary code within the renderer sandbox. No public exploit code is identified in the provided data, and full system compromise would require an additional sandbox-escape bug.