Google Chrome: Race condition in Core on macOS allows sandbox escape
Summary
A race condition in the Core component of Google Chrome on macOS can be abused by an attacker who has already compromised the renderer process. The attacker uses social engineering and a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. Exploitation requires user interaction, a high attack complexity and a prior renderer compromise, so the bug is a chained vulnerability and not a standalone entry point.
Affected
- Google Chrome on macOS prior to 155.0.8059.39
- Windows and Linux are not named in the CVE description
- CVSS 3.1: 8.3 (High), CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Fixed in
- Google Chrome 155.0.8059.39 or later for macOS (per secondary sources; vendor release notes not verified)
- Newer Stable builds are reported but the exact build number is not confirmed
Workaround
- Unknown. No vendor-documented workaround. Updating Chrome is the remedy.
Exploitation
- CISA KEV: not listed
- No Google statement or report of in-the-wild exploitation for this CVE found
- Public proof-of-concept: none found
- EPSS score: unknown
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
Our recommendation
- Update Google Chrome on all Macs to the latest Stable build now.
- Check the installed version via chrome://version or your MDM inventory.
- Prioritise Macs where updates are deferred or disabled.
- Keep browser auto-update enabled and monitor the Chrome Releases blog for further Stable updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker entry issues.chromium.org
- OSV entry DEBIAN-CVE-2026-106412 osv.dev
- Strix CVE record CVE-2026-106412 www.strix.ai
- Horus Valley: Chrome 155 security update www.horusvalley.com
- Cyberkendra: CVE-2026-106378 Chrome macOS GPU sandbox escape www.cyberkendra.com
- GitHub alert for CVE-2026-106412 (EPSS unknown) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:03.
Original description (NVD)
Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.