CVE-2026-106378: Google Chrome Privilege Escalation Vulnerability

CVE-2026-106378 Overview

CVE-2026-106378 is a sandbox escape vulnerability in Google Chrome on macOS. The flaw allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox. Exploitation requires a crafted HTML page and user interaction. The issue affects Google Chrome versions prior to 155.0.8059.39 on macOS and is categorized under [CWE-250] Execution with Unnecessary Privileges. Google Chrome shipped a fix in the Stable channel update for desktop. The Chromium project assigned a Medium internal severity, while the National Vulnerability Database (NVD) rates the issue higher due to the scope change and full compromise of confidentiality, integrity, and availability.

Critical Impact
A successful exploit chain lets an attacker break out of the Chrome renderer sandbox on macOS and run code with the privileges of the browser process, bypassing a core defense-in-depth boundary.

Affected Products

Google Chrome on macOS prior to 155.0.8059.39
Apple macOS (host operating system)
Chromium-based browsers on macOS inheriting the vulnerable sandbox code path

Discovery Timeline

2026-10-06 - CVE-2026-106378 published to the National Vulnerability Database
2026-10-07 - Last updated in the NVD database

Technical Details for CVE-2026-106378

Vulnerability Analysis

The vulnerability resides in Chrome's Sandbox component on macOS. The sandbox is designed to isolate the renderer process so that memory corruption bugs in web content parsing cannot translate into host code execution. CVE-2026-106378 breaks that boundary. An attacker who already controls the renderer, typically through a prior web-content bug, can leverage the flaw to execute arbitrary code outside the sandboxed context.

The scope change reflected in the CVSS vector indicates that the exploit crosses a trust boundary, moving from the restricted renderer to the broader browser process context. Successful exploitation grants full read, write, and execution impact on data accessible to the browser process, including session cookies, saved credentials, and loaded extensions.

Root Cause

The weakness maps to [CWE-250] Execution with Unnecessary Privileges. A sandboxed component either retained or acquired privileges that should have been dropped before processing attacker-influenced input. The Chromium issue tracker entry (#507596239) documents the specific defect but is access-restricted at time of publication. See the Chromium Issue #507596239 tracker for details as they become public.

Attack Vector

Exploitation requires chaining with a renderer compromise. The adversary hosts a crafted HTML page and lures the victim to visit it. After the first-stage renderer exploit executes, the sandbox escape triggers to elevate the attacker's code outside the sandboxed macOS process. User interaction is required, which typically means navigation to the attacker-controlled page. No valid credentials or prior access to the host are needed.

No public proof-of-concept is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The Exploit Prediction Scoring System places the probability of near-term exploitation in the lower range.

Detection Methods for CVE-2026-106378

Indicators of Compromise

Chrome Helper (Renderer) processes on macOS spawning child processes or writing to paths outside the standard Chrome application support directories.
Unexpected network connections from the main Chrome process to previously unseen domains following visits to untrusted sites.
Creation of unsigned Mach-O binaries or launch agents under user Library paths shortly after browser activity.

Detection Strategies

Monitor process lineage for anomalous children of Google Chrome Helper (Renderer) and Google Chrome processes, particularly shell interpreters, osascript, or curl.
Alert on Chrome process writes to ~/Library/LaunchAgents, ~/Library/LaunchDaemons, or persistence locations in user profile directories.
Correlate browser telemetry with endpoint detection and response (EDR) data to identify renderer crashes immediately followed by privileged file or network activity.

Monitoring Recommendations

Centralize macOS Unified Log and EDR process events in a security data lake to retain context for post-exploit investigation.
Track installed Chrome versions across the fleet and alert when hosts remain below 155.0.8059.39.
Baseline normal Chrome child-process behavior per user population to surface deviations after high-risk browsing sessions.

How to Mitigate CVE-2026-106378

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 155.0.8059.39 or later.
Force relaunch of the browser after update to ensure the patched binary is loaded, as users with always-open browser sessions remain exposed until restart.
Audit managed Chromium-based browsers on macOS for an equivalent patched release from their upstream vendor.

Patch Information

Google released the fix in the Stable channel update tracked in the Google Chrome Stable Update advisory. Deploy Chrome 155.0.8059.39 or newer on macOS. Enterprises using managed update policies should verify that the UpdatePolicy is set to allow automatic updates and that the update cadence has delivered the patched build.

Workarounds

Restrict browsing on vulnerable hosts to trusted internal sites until the patched version is deployed.
Enforce Chrome Enterprise policies that block execution of unknown or untrusted extensions, reducing the renderer attack surface.
Apply macOS application sandbox and system integrity protections, and consider deploying additional endpoint controls that monitor browser child-process creation.

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Enterprise managed update enforcement example (plist key)
sudo defaults write /Library/Preferences/com.google.Keystone.Agent checkInterval -int 3600