Google Chrome CVE-2026-106300

Exploitation requires the attacker to have ALREADY compromised the renderer process (a prior code-execution foothold in Chrome's sandboxed renderer, typically via a separate chained vulnerability) - this flaw alone does not grant initial access. The victim must also load attacker-controlled content (UI:R; a crafted HTML page) so the attacker can drive CacheStorage operations and win a timing-dependent race (CWE-367), which is inherently non-deterministic and may require multiple attempts. Impact is limited to reading memory outside the sandbox (confidentiality only; no integrity or availability impact) and affects Chrome versions before 155.0.8059.39 on desktop. The requirement for a pre-existing renderer compromise is the dominant limiting factor and relegates this to a chain component rather than a primary entry point.

This is a genuine-but-low-priority issue, and the signals are consistent in pointing that way. The vendor-assigned CVSS is 4.7 (Medium), EPSS is 0.14% (3rd percentile - very low predicted exploitation), it is NOT on the CISA KEV list, and no public exploit code was identified in the provided data. Exploitation status: no public exploit identified at time of analysis. The single most important mitigating factor is buried in the description: the attacker must ALREADY have 'compromised the renderer process.' This means the flaw (CWE-367, a TOCTOU race condition in CacheStorage enabling a read of memory outside the sandbox) is not a standalone remote compromise - it is a sandbox-boundary information-disclosure primitive useful only as a secondary link in a larger exploit chain. The provided CVSS vector (AV:N/AC:L/PR:N/UI:R) carries PR:N, which per the precision rules reads as unauthenticated; this CONFLICTS with the description's explicit requirement of a pre-compromised renderer, so authentication/privilege requirements are not cleanly represented by the vector. Chromium's scoring convention treats renderer compromise as an assumed starting state rather than a 'privilege,' which explains the PR:N, but defenders should read this as requiring a prior foothold. Scope is Changed (S:C), correctly reflecting that the impact crosses the sandbox boundary, and impact is confidentiality-only and Low (C:L/I:N/A:N). Net: real, patch-worthy, but not an emergency - standard Chrome auto-update cadence is the appropriate response.

An attacker first gains code execution in Chrome's renderer process via a separate bug (e.g., a V8/HTML rendering flaw) when a victim visits a malicious page. They then serve a crafted HTML page that drives CacheStorage operations to win a timing race (CWE-367), using the resulting read to leak memory from outside the renderer sandbox - information such as pointers or secrets that aids escalating the chain toward a full sandbox escape. No public proof-of-concept was identified at the time of analysis.