Google Chrome CVE-2026-106293

Exploitation requires that the attacker has ALREADY compromised Chrome's renderer process - this bug is a sandbox-escape primitive, not an initial-access vector, so it cannot be triggered by merely visiting a page without a separate renderer exploit first. The victim must load attacker-controlled graphics content (crafted HTML invoking ANGLE/WebGL code paths), so user interaction (UI:R) is required. Limiting factors: the AC:H rating and the need for a working renderer compromise substantially raise the bar; it only matters as the second stage of a multi-bug chain. Affects Chrome versions before 155.0.8059.39 on platforms where ANGLE is used; updating to 155.0.8059.39 or later removes the flaw.

This is a genuinely serious memory-corruption flaw (CWE-843 type confusion in ANGLE, Chrome's OpenGL ES abstraction layer) but with an important real-world caveat that tempers raw-severity panic. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H = 8.3 High) encodes the key nuance: although attack vector is Network and privileges are None, the description explicitly states the attacker must have ALREADY compromised the renderer process, and AC:H plus UI:R reflect that this is not a standalone one-click RCE but a sandbox-escape link in an exploit chain. The Scope:Changed (S:C) and total technical impact correctly capture that success means code execution OUTSIDE the Chromium sandbox - i.e., full compromise of the host browser process. Countervailing signals lower the immediate priority: SSVC reports Exploitation=none and Automatable=no, there is no CISA KEV listing, and no public exploit identified at time of analysis. So despite the high CVSS, this is currently a patch-promptly-but-not-emergency issue: dangerous as part of a chain, not independently wormable. Note a modeling tension worth flagging: CVSS lists PR:N, yet the vulnerability is only reachable given a prior renderer compromise - the 'privilege' precondition is expressed through AC:H/chaining rather than PR, which is standard Chromium scoring convention but can mislead automated prioritization that reads PR:N as 'trivially unauthenticated.'

An attacker who has already exploited a separate renderer bug (e.g., a V8 or DOM flaw) uses the compromised renderer to feed crafted WebGL/graphics operations through ANGLE, triggering the type confusion to corrupt memory and execute code in the higher-privileged browser process, escaping the sandbox. In practice this is delivered by luring a victim to a malicious or compromised web page that stages both the initial renderer compromise and this escape. No public exploit code has been identified at time of analysis, and SSVC currently rates exploitation as none.