Google Chrome CVE-2026-106327

Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process - this is a chained, second-stage sandbox/access-restriction bypass, not a standalone remote compromise, so a separate renderer-level exploit is a hard prerequisite. The victim must then load attacker-controlled content: the flaw is triggered via a crafted HTML page, and the CVSS vector's UI:R indicates user interaction (navigating to or rendering the page) is required. The primary limiting factor is the compromised-renderer precondition, which substantially raises real-world attack complexity; the fix is to update Chrome to 155.0.8059.39 or later.

This is a moderate-severity, second-stage vulnerability, not a standalone priority. The CVSS 3.1 base score is 6.1 (vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting a scope change (sandbox/privilege boundary crossing) but only Low confidentiality and integrity impact and no availability impact. The description is the most important signal and partially conflicts with the vector: exploitation requires an attacker who 'had compromised the renderer process' - i.e. this is a sandbox/access-restriction bypass that must be chained to a prior renderer-level RCE, yet the vector scores PR:N. The PR:N reflects Chromium's convention of scoring the external attacker rather than the renderer-compromise precondition, so the real-world attack complexity is higher than AC:L implies. Supporting signals indicate low urgency: EPSS is 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit code is referenced. A patch is available from the vendor. In short, a genuinely useful bug for an attacker already inside the renderer sandbox, but not independently exploitable and not currently associated with active exploitation - patch on normal browser-update cadence rather than emergency timelines.

An attacker who has already compromised a Chrome renderer process (via a separate, chained exploit) lures or has the victim load a crafted HTML page, which triggers the incorrect-authorization flaw in Chrome's Core component to escape renderer restrictions and reach otherwise-protected system resources. No public exploit code was identified at time of analysis, and there is no evidence of active exploitation.