CVE-2026-106238

Summary

A race condition in Google Chrome's font handling allows a compromised renderer process to execute arbitrary code outside the sandbox, potentially leading to full system compromise. This represents a critical escalation path for attackers who already have renderer-level access.

Exploitability

Exploitation requires an attacker who has already compromised the renderer process, making it moderately difficult but possible with a crafted HTML page that triggers the race condition in the font handling code.

Blast radius

If exploited, this vulnerability could allow attackers to escape the Chrome sandbox and execute arbitrary code on the host system, potentially affecting all user data and applications running on the machine.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Google Chrome version 155.0.8059.39 or later to remediate this race condition vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.