Google Chrome CVE-2026-106426

Exploitation requires the victim to load attacker-controlled HTML that exercises Chrome's font code path, triggering a race condition (CWE-362) to escape the browser sandbox; this is a bug in default Chrome font handling with no special non-default configuration implied. Limiting factors: required user interaction (UI:R - the victim must visit/render the malicious page) and high attack complexity (AC:H), since the attacker must reliably win a timing-dependent race, which typically requires multiple attempts and precise memory grooming. Affects Chrome versions prior to 155.0.8059.39; updating to that build or later removes exposure.

This is a credible high-priority browser flaw but not a confirmed emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, score 8.3) describes a remotely reachable, unauthenticated sandbox escape (scope change S:C) with full CIA impact - serious because it breaks Chrome's primary security boundary. Two signals temper this: AC:H reflects the inherent difficulty of reliably winning a race condition (CWE-362), and UI:R means the victim must actively load attacker content. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - consistent with a vendor-reported (Chrome/Google internal) finding patched before weaponization. EPSS and KEV data are MISSING rather than low, so widespread-exploitation likelihood cannot be quantified from this input; the practical risk is driven by Chrome's enormous install base and the historical tendency for Chromium renderer/sandbox bugs to be reverse-engineered from patches. Verdict: patch promptly, but this is not currently in the confirmed-exploited tier.

An attacker hosts a crafted HTML page exercising Chrome's font handling and lures a victim to visit it (ad, link, or compromised site). By repeatedly triggering the font-processing race condition, the attacker corrupts memory to escape the renderer sandbox and run arbitrary code on the host. No public POC is known, and the high attack complexity (AC:H) means the race must be won reliably, making real-world exploitation non-trivial.