CVE-2026-106409

Summary

A flaw in how Chrome on Mac handles web app installations allows a compromised renderer process to execute arbitrary code outside the sandbox, potentially leading to full system compromise. This affects Google Chrome and macOS systems.

Exploitability

Exploitation requires a remote attacker who has already compromised the renderer process, making it moderately difficult but possible with a follow-up attack vector, and relies on the victim using Chrome with web app installation features.

Blast radius

The impact could be significant across all Mac users running affected Chrome versions, potentially allowing attackers to execute arbitrary code with system-level privileges and access sensitive user data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Chrome 155.0.8059.39 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.