CVE-2026-106412: Race condition in Google Chrome

CVE-2026-106412 is a race condition vulnerability in the Core of Google Chrome on Mac platforms before version 155.0.8059.39. An attacker who has already compromised the renderer process and employs social engineering techniques can exploit this flaw by delivering a specially crafted HTML page, which may lead to arbitrary code execution outside the browser sandbox. This vulnerability elevates the risk of code execution beyond the renderer sandbox, increasing the potential impact of a renderer compromise.

Successful exploitation could allow an attacker with control over the renderer process to execute arbitrary code outside the sandbox on the victim's Mac system. This could lead to further system compromise beyond the browser sandbox restrictions. However, exploitation requires prior compromise of the renderer process and social engineering to deliver the malicious content.

A fix is available in Google Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html for details.