CVE-2026-106378

Think of Chrome's sandbox like a locked room designed to contain a thief even if they break into your house's front hallway. This flaw is a weak spot in that locked room's wall — if an attacker already got into the hallway (compromised part of Chrome), this bug could let them break through the wall into the rest of the house and take full control of the computer.

This matters to you if your team uses Google Chrome on Mac computers. It only becomes a real risk if an attacker has already managed to compromise the browser's renderer process through a separate flaw — this vulnerability alone isn't enough to break in, it's the second step of a two-step attack chain.

There is no evidence this is being actively exploited — it's not on the government's confirmed-exploitation list and no public attack code exists, so this doesn't require emergency weekend action. Still, treat it as a real risk worth addressing in your normal patch cycle since it requires a second, separate flaw to be useful to an attacker, and media coverage has been sustained, suggesting researchers are paying close attention.

Confirm exposure by checking chrome://version on affected Mac endpoints; any version prior to 155.0.8059.39 is vulnerable. Chrome's auto-update mechanism typically handles this automatically on next restart, but for managed fleets, verify via your MDM/endpoint management console that all Mac clients report 155.0.8059.39 or later. There is no documented workaround since this is a sandbox-layer flaw triggered via crafted HTML and requires chaining with a renderer-compromise vulnerability — patching is the only mitigation. Not listed in CISA KEV, so no federal remediation deadline applies. Monitor the vendor release notes (chromereleases.googleblog.com) for any follow-up advisories indicating active exploitation status changes, and review EDR/browser telemetry for anomalous renderer-process crashes or escalations on Mac endpoints as a precaution.

CVSS 3.1 score 8.3 (High) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, reflecting high attack complexity and required user interaction but high impact once triggered. Weakness class is CWE-250 (Execution with Unnecessary Privileges), manifesting as a sandbox escape from the renderer process. Chromium internally rates this 'Medium' severity, consistent with it being a secondary escalation step rather than a standalone initial-access vector. EPSS places exploitation likelihood in the lower range with a flat trend, and no public exploit code or KEV listing exists, indicating low current exploit maturity despite sustained press attention.