CVE-2026-106292: Buffer overflow in Google Chrome

CVE-2026-106292 is a buffer overflow vulnerability in the Fonts component of Google Chrome versions before 155.0.8059.39. An attacker who has already compromised the renderer process could exploit this vulnerability by delivering a specially crafted HTML page, enabling arbitrary code execution outside the sandbox environment. This elevates the risk of further compromise on the affected system. The vulnerability has been assigned a CVSS v3.1 score of 8.3, indicating high severity. The vendor has published an advisory indicating a stable channel update addressing this issue.

Successful exploitation could allow an attacker to execute arbitrary code outside the sandbox, potentially leading to full system compromise or further escalation of privileges. The vulnerability affects the confidentiality, integrity, and availability of the system as indicated by the CVSS vector (C:H/I:H/A:H).

A fix is available in Google Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html for details and update instructions.