CVE-2026-106377: Race condition in Google Chrome

CVE-2026-106377 is a race condition vulnerability in the Fonts subsystem of Google Chrome versions before 155.0.8059.39. An attacker who has already compromised the renderer process can exploit this flaw to execute arbitrary code outside the sandbox environment by using a specially crafted HTML page. This elevates the attacker's capabilities beyond the renderer sandbox, increasing the potential impact of an initial compromise. The vulnerability has been assigned a CVSS v3.1 base score of 8.3, indicating high severity. Google has released a stable channel update that addresses this issue in version 155.0.8059.39.

Successful exploitation allows remote code execution outside the sandbox from the renderer process, potentially leading to full system compromise. The vulnerability requires the attacker to have already compromised the renderer process and involves user interaction (UI:R). The impact includes complete confidentiality, integrity, and availability loss as indicated by the CVSS metrics.

Google has released an official fix in Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.