CVE-2026-106377

Summary

A race condition in Google Chrome's font handling allows a compromised renderer process to execute arbitrary code outside the sandbox, potentially leading to full system compromise. This vulnerability is particularly dangerous because it can be exploited remotely and leverages a pre-compromised state.

Exploitability

Exploitation requires a remote attacker to first compromise the renderer process, making it moderately difficult but possible with a follow-up attack vector; the attacker needs to craft a malicious HTML page that triggers the race condition.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the victim's system with the privileges of the Chrome process, potentially leading to full system compromise or data exfiltration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Google Chrome version 155.0.8059.39 or later to remediate this race condition vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.