Google Chrome CVE-2026-106412

Exploitation requires a chain of specific prerequisites, not a single remote shot: (1) the attacker must already have compromised the Chrome renderer process; (2) the target must be running Chrome on macOS at a version prior to 155.0.8059.39; (3) the victim must perform the required user interaction (UI:R) after being socially engineered into opening/interacting with a crafted HTML page; and (4) the attacker must successfully win the timing-dependent race condition (CWE-367) in the Core component, which the AC:H rating and SSVC Automatable=no indicate is unreliable and not readily scriptable. Limiting factors that reduce real-world risk: the mandatory pre-existing renderer compromise, the social-engineering/user-interaction dependency, the macOS-only and pre-155.0.8059.39 version constraint, and the difficulty of reliably winning the race. Default configurations are affected only once the renderer is already compromised.

This is a genuine but conditional priority rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C, C:H/I:H/A:H → 8.3 High) reflects a sandbox-escape with total impact and a scope change, but two signals temper the raw score: AC:H (the race/TOCTOU window is hard to win reliably) and the description's explicit precondition that the attacker must FIRST have compromised the renderer process and employed social engineering - so PR:N is technically correct for the final stage yet understates the multi-stage effort required. All real-world-exploitation signals point low: SSVC records Exploitation=none and Automatable=no (consistent with a timing-dependent race that cannot be reliably scripted at scale), there is no CISA KEV listing, and no public exploit was identified. SSVC Technical Impact=total aligns with C:H/I:H/A:H. There is no EPSS score in the provided data, so probabilistic exploitation likelihood cannot be quantified here. Net: high ceiling impact (full sandbox escape on a ubiquitous browser) but currently low realized risk, gated by a difficult race condition and the need for a pre-existing renderer compromise plus user interaction. Patch promptly given Chrome's install base, but this is not evidence of mass or automated exploitation.

An attacker who has already achieved code execution in Chrome's renderer sandbox (e.g., via a separate renderer bug) lures a macOS user into opening or interacting with a crafted HTML page, then wins a timing race in a Core component to corrupt state and break out of the sandbox onto the host. No public exploit code is known, and the high attack complexity (AC:H) means the race must be won reliably, so weaponization is non-trivial.