CVE-2026-106412: Google Chrome Race Condition Vulnerability

CVE-2026-106412 Overview

CVE-2026-106412 is a race condition vulnerability in the Core component of Google Chrome on macOS. The flaw affects Chrome versions prior to 155.0.8059.39. A remote attacker who has already compromised the renderer process can leverage social engineering to execute arbitrary code outside the Chrome sandbox through a crafted HTML page. The vulnerability is classified under CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition. Google rates the Chromium security severity as High. Successful exploitation breaks the sandbox boundary that normally isolates web content from the host operating system.

Critical Impact
Attackers chaining this flaw with a renderer compromise can escape the Chrome sandbox on macOS and execute arbitrary code with the privileges of the browser process.

Affected Products

Google Chrome on macOS prior to 155.0.8059.39
Apple macOS (host platform for the vulnerable Chrome builds)
Chromium-based browsers on macOS sharing the affected Core code path

Discovery Timeline

2026-10-06 - CVE-2026-106412 published to the National Vulnerability Database
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106412

Vulnerability Analysis

The issue is a race condition inside Chrome's Core component on macOS. Race conditions arise when the ordering or atomicity of concurrent operations is not enforced. An attacker who already controls the renderer process can time operations across threads to manipulate shared state during a narrow window. This window allows the attacker to influence privileged logic that normally runs outside the sandboxed renderer. The outcome is arbitrary code execution outside the Chrome sandbox on the macOS host. Exploitation requires user interaction, since the attacker must deliver and convince the user to interact with a crafted HTML page. Google's advisory confirms the fix shipped in Chrome 155.0.8059.39 for desktop channels.

Root Cause

The root cause maps to [CWE-367], a time-of-check to time-of-use flaw. State validated at one point in execution changes before it is consumed, because concurrent threads mutate shared resources without sufficient synchronization. In a browser context, this pattern can let a compromised renderer feed unexpected values into higher-privilege Chrome components during the race window.

Attack Vector

Exploitation requires two preconditions. First, the attacker must compromise the renderer process, typically through a separate memory corruption or logic bug in web content handling. Second, the attacker must deliver a crafted HTML page and rely on social engineering to drive the required user interaction. Once both conditions are met, winning the race lets attacker-controlled code run outside the sandbox on macOS.

No verified public exploit code is available. See the Chromium Issue Tracker Entry and the Google Chrome Stability Update for vendor technical references.

Detection Methods for CVE-2026-106412

Indicators of Compromise

Chrome renderer or helper processes on macOS spawning unexpected child processes such as /bin/sh, osascript, or curl.
Chrome versions below 155.0.8059.39 reported by endpoint inventory on macOS hosts.
Outbound network connections from Chrome helper processes to newly registered or low-reputation domains hosting HTML payloads.

Detection Strategies

Monitor process ancestry for Google Chrome Helper (Renderer) and Google Chrome Helper (GPU) creating non-browser child processes.
Alert on file writes by Chrome helper processes to persistence locations such as ~/Library/LaunchAgents/ or ~/Library/Application Support/.
Correlate Chrome crash telemetry with suspicious outbound traffic from the same host within a short time window.

Monitoring Recommendations

Ingest macOS Endpoint Security (ES) events and Chrome crash reports into a centralized analytics pipeline.
Track Chrome version drift across managed macOS fleets and flag endpoints running builds older than 155.0.8059.39.
Review MDM compliance reports to confirm forced-update policies are enforcing the patched Chrome build.

How to Mitigate CVE-2026-106412

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 155.0.8059.39 or later.
Restart Chrome after update to ensure the patched binary is loaded in all running sessions.
Audit managed macOS fleets for Chromium-based browsers that may share the affected Core code and apply vendor updates as available.

Patch Information

Google addressed CVE-2026-106412 in the Chrome Stable channel release documented in the Google Chrome Stability Update. Users should install Chrome 155.0.8059.39 or later on macOS. Enterprise administrators should push the update through MDM or Chrome Browser Cloud Management to force restart within the maintenance window.

Workarounds

Enforce site isolation and keep sandboxing enabled; do not launch Chrome with --no-sandbox on macOS.
Restrict execution of browsers to patched versions through application allowlisting on managed macOS endpoints.
Train users to avoid interacting with untrusted HTML content or links from unverified senders until patching is complete.

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Example Jamf policy trigger to enforce Chrome update
sudo jamf policy -event update-chrome