CVE-2026-106238: Google Chrome Race Condition Vulnerability

CVE-2026-106238 Overview

CVE-2026-106238 is a race condition vulnerability [CWE-362] in the Fonts component of Google Chrome prior to version 155.0.8059.39. An attacker who has already compromised the renderer process can exploit this flaw to potentially execute arbitrary code outside the Chrome sandbox. Exploitation requires a crafted HTML page and user interaction. Chromium rates the security severity as Medium, while the NVD assigns an 8.3 CVSS score reflecting the scope change and high confidentiality, integrity, and availability impact when the sandbox is escaped.

Critical Impact
Successful exploitation allows sandbox escape from a compromised Chrome renderer process, enabling arbitrary code execution in the broader browser or host context.

Affected Products

Google Chrome versions prior to 155.0.8059.39 (Desktop Stable channel)
Chromium-based builds incorporating the vulnerable Fonts component
Downstream browsers that have not merged the upstream Chromium fix

Discovery Timeline

2026-10-06 - CVE-2026-106238 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106238

Vulnerability Analysis

The flaw resides in the Fonts subsystem of Chrome and is classified as a race condition [CWE-362]. Chrome's multi-process architecture isolates web content inside a sandboxed renderer process. The Fonts component crosses that boundary to coordinate font data between the renderer and more privileged processes. A race in that coordination path lets a malicious actor interleave operations and corrupt state that is later trusted outside the sandbox.

The vulnerability chains with an existing renderer compromise. An attacker must first gain code execution in the renderer, typically through a separate browser bug or malicious script, and then race the Fonts handling logic to break out. The result is sandbox escape, which elevates attacker control from the restricted renderer to resources normally shielded by the browser's security boundary.

Root Cause

The root cause is a time-of-check to time-of-use condition in Fonts processing. Shared state is accessed by concurrent threads or processes without adequate synchronization. By repeatedly triggering the operation, an attacker can win the race and manipulate memory or control-flow data between validation and use.

Attack Vector

The attack vector is network-based through a crafted HTML page that loads attacker-controlled font resources or scripts. Exploitation requires user interaction, such as visiting a malicious or compromised site. It also depends on prior compromise of the renderer process, which raises attack complexity but does not neutralize the risk given the frequency of renderer-level bugs.

No public proof-of-concept, exploit database entry, or evidence of in-the-wild exploitation is listed for this CVE. The issue is not present in the CISA Known Exploited Vulnerabilities catalog. Refer to the Chromium Issue Tracker #492374387 for upstream technical context.

Detection Methods for CVE-2026-106238

Indicators of Compromise

Chrome renderer processes spawning unexpected child processes or writing to non-standard paths on disk.
Browser crash reports referencing the Fonts subsystem or font-related modules immediately after loading untrusted pages.
Outbound connections from browser-spawned processes to unfamiliar hosts following visits to suspicious URLs.

Detection Strategies

Monitor endpoint telemetry for anomalous Chrome process lineage, especially non-renderer child processes created after a renderer crash.
Correlate browser version strings from user-agent logs or asset inventories against the fixed version 155.0.8059.39 to surface unpatched endpoints.
Hunt for repeated DOM operations loading custom font files, which can indicate attempts to trigger the race condition.

Monitoring Recommendations

Centralize Chrome crash telemetry and alert on repeated Fonts-related signatures across multiple hosts.
Track execution of binaries dropped by browser processes and alert on any post-exploitation tooling.
Review proxy and DNS logs for traffic to newly registered or low-reputation domains serving font-heavy HTML content.

How to Mitigate CVE-2026-106238

Immediate Actions Required

Update Google Chrome to version 155.0.8059.39 or later on all desktop endpoints.
Force-restart Chrome after deploying the update to ensure the patched binary is loaded in memory.
Audit managed Chromium-based browsers and apply vendor updates that include the upstream fix.

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release documented in the Google Chrome Update Announcement. Administrators should validate the deployed version matches or exceeds 155.0.8059.39 across Windows, macOS, and Linux fleets. Enterprise deployments managed through Chrome Browser Cloud Management or group policy should confirm automatic update channels are enabled.

Workarounds

Enforce site isolation and restrict high-risk browsing to hardened, segmented environments until patching completes.
Use enterprise policies to block execution of untrusted browser extensions that could facilitate renderer compromise.
Apply URL allowlisting or web filtering to reduce exposure to untrusted sites that could deliver the crafted HTML trigger.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Example group policy check on Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion