Google Chrome: Privilege elevation via sandbox escape on macOS

Summary

Google Chrome on macOS contains a sandbox flaw that allows privilege elevation. A remote attacker who has already compromised the renderer process can use a crafted HTML page to execute arbitrary code outside the sandbox. The attack requires a separate renderer compromise and user interaction, so the flaw is typically exploited as part of a chain.

Affected

• Google Chrome on macOS prior to 155.0.8059.39 (per the CVE record)
• Other platforms: see vendor advisory, the CVE record covers macOS only

Fixed in

• Google Chrome 155.0.8059.39/.40 for macOS or later (per HKCERT and release coverage)
• Newer stable line 155.0.8059.79/.80 released on 13 October 2026; fix in this build not verified

Workaround

• Unknown. No vendor workaround identified; apply the update.

Exploitation

• No evidence of in-the-wild exploitation known at the time of research.
• Not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS below 1%.

Our recommendation

• Update Chrome on all Mac systems to the current stable build via auto-update and verify the installed version.
• Check that managed Mac fleets are not stuck on older Chrome versions.
• Keep browser patching in the regular cycle, as the flaw is part of a possible exploit chain with renderer bugs.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  leisureprog/CVE-2026-106378

Research sources

• Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
• Chromium issue tracker issues.chromium.org
• OpenCVE CVE-2026-106378 app.opencve.io
• HKCERT security bulletin www.hkcert.org
• gHacks: Chrome 155 security fixes www.ghacks.net
• TechJournal: Chrome 155 critical security update techjournal.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:05.