CVE-2026-106201

Executive Summary

CVE-2026-106201 is a race condition (CWE-362) in the V8 JavaScript and WebAssembly engine affecting Google Chrome versions prior to 155.0.8059.39. A remote attacker can trigger the flaw via a crafted HTML page, achieving arbitrary code execution inside the browser sandbox, though not escaping it. Per the CNA-supplied CVSS 3.1 assessment, the vulnerability rates 8.8 (High), requiring user interaction, with High confidentiality, integrity, and availability impact.

Technical Analysis

The vulnerability resides in V8, Chrome's JavaScript engine. The NVD description classifies it precisely as a "race condition in V8" — a memory-safety defect arising from unsynchronized concurrent access to shared state. Concurrency in V8 is real and pervasive: isolation between browser tabs does not extend to individual JavaScript objects, and the engine's optimizing compiler, garbage collector, inline caches, and background compilation threads all execute concurrently. A race condition in this context typically permits one thread to observe or mutate an object while another thread is mid-mutation, yielding a stale pointer, a type confusion, or an out-of-bounds reference. The attacker's objective in a V8 race condition is to convert that transient inconsistency into read/write primitives over memory that V8 believes it fully controls.

What is explicitly stated, and therefore established, is the flaw class (CWE-362) and its locus (V8). Everything below the class level — the specific object, the specific API, the specific serialization step that fails to synchronize — is not disclosed. The NVD description does not name any function, object type, or API surface; the CNA title is empty; and the affected-version and OSV package lists supplied are empty. The report therefore deliberately stops at the vulnerability-class boundary rather than inventing implementation specifics.

The attack surface is the standard web content surface: the HTML parser, the JavaScript parser, and the engine's normal execution pipeline. The vulnerability is reachable through remote content, which means the attacker does not require a local foothold, a malicious download, or network adjacency. It requires a single page rendering in a vulnerable browser. This is consistent with the "crafted HTML page" attack vector and with the CVSS network vector accompanied by UI:R (user must open or view the page).

CVSS 3.1 scoring of 8.8 with AV:N/AC:L/PR:N/UI:R/S:U reflects a classic client-side engine compromise: a low-complexity, remotely reachable, unauthenticated attack requiring one user interaction, with complete loss of confidentiality, integrity, and availability within the scope of the affected component. The CNA assigns a Chromium security severity of Medium, consistent with the fact that this is an in-sandbox arbitrary code execution primitive — severe in isolation, but not a sandbox escape. Sandbox escape would require a second, independent vulnerability in the OS-level sandbox (on Windows, the sandbox broker; elsewhere, the equivalent).

Because this is a race condition, the exploit is not deterministic. An attacker must win a timing window, which typically necessitates many attempts, heap grooming, or page-reload loops. This affects both reliability and detection: malformed or repeatedly-reloaded pages that touch the engine's concurrent paths are the observable footprint, not a single static payload.

Assessment of current exposure: no public proof-of-concept, no Nuclei template, no exploit code, and no CISA KEV listing are present in the supplied data. Exploitation in the wild is therefore not evidenced. The absence of a KEV entry is consistent with the vendor severity of Medium and with the requirement to chain a second vulnerability for full system compromise.

Exploitation Scenarios

No public PoC exists for CVE-2026-106201. The following chain is inferred at the vulnerability-class level and reconstructs how a V8 race condition is typically weaponized.

1) Reconnaissance and target identification. The attacker enumerates users of vulnerable Chrome builds. This is passive and inexpensive: the version string is often visible to the attacker's own page via the User-Agent header or client hints, allowing the page to self-select victims and serve the payload only to Chrome versions below 155.0.8059.39. No scanning of the victim host is required; the "reconnaissance" is performed by the victim's browser identifying itself to attacker-controlled content. Standard web lures apply: malicious advertisements, compromised legitimate sites, phishing pages, or any page where the attacker can inject script.

2) Triggering the specific flaw class. The victim navigates to the crafted HTML page. JavaScript in the page drives concurrent execution against the vulnerable V8 subsystem — regardless of the precise subsystem, the goal is to cause two concurrent operations to interleave in a window the engine assumes is atomic. The CVSS profile (UI:R, AC:L) matches a page that forces the interaction through ordinary script execution, then repeats the timing attempt until it succeeds. Because the window is timing-dependent, the page must be built to retry rapidly, often with careful allocation and garbage-collection manipulation.

3) Payload/execution method at the class level. Winning the race yields a corrupted memory primitive inside the engine; the standard progression is to escalate that primitive into arbitrary read/write within the renderer process, and then into control-flow hijack by redirecting execution to attacker-chosen code. All of this occurs inside the renderer sandbox. The attacker cannot, at this stage, write files to disk, persist, or touch other processes on the host — that ceiling is structural, and is why the CNA rates this Medium.

4) Post-exploitation impact. Within the sandbox, the attacker has arbitrary code execution in the renderer: reading DOM content and same-origin data, exfiltrating form fields, cookies, and session tokens, redirecting requests, and manipulating any page the renderer has access to. Because V8 sits beneath every site the browser loads, an in-sandbox primitive can be turned into cross-origin data theft against any domain the victim visits in the affected profile. Achieving host-level compromise requires a second, unrelated sandbox-escape bug; CVE-2026-106201 alone is not a full chain. Automated exploitation is realistic at scale given the network-reachable, user-interaction-only attack profile.

Impact Assessment

The blast radius is every Google Chrome installation running a build below 155.0.8059.39 that renders attacker-supplied web content. Because Chrome is among the most widely deployed desktop and mobile browsers, the vulnerable population is large, but the attack is opportunistic rather than wormable: it requires a victim to visit a page under attacker influence.

Confidentiality and integrity impacts are High (C:H/I:H). A functioning exploit gives the attacker arbitrary code execution inside the renderer, with read access to that renderer's memory — including page data, secrets, tokens, and user-entered content — and the ability to alter what the user sees and submits. Availability is High (A:H): a race-condition exploit that corrupts engine memory can also crash or hang the renderer at will. Scope is Unchanged (S:U) in the CVSS vector, which is the correct reading for an in-sandbox primitive: the exploited component (V8) and the impacted security authority (the renderer) are the same authority.

The nuance that security teams should carry forward is the difference between "arbitrary code execution" in the NVD wording and "arbitrary code execution on the endpoint." The former is accurate to the renderer. The sandbox is not defeated. That distinction materially reduces worst-case impact for host security but does not reduce the confidentiality risk for web application sessions running through the affected browser.

No CISA KEV listing, no EPSS score (FIRST.org has not yet scored it), and no public exploit code. The practical urgency is driven by patch availability rather than observed exploitation.

Detection Guidance

Sigma Rule

Detects Chrome process instances whose version predates the fix, using image metadata where available, and flags suspicious browser launch behavior consistent with exploit delivery.

title: Vulnerable Google Chrome Version Below 155.0.8059.39 (CVE-2026-106201)
id: 9a1f4c2e-7b3d-4e88-9c01-106201vc8rac
status: experimental
description: Identifies systems running Google Chrome builds prior to 155.0.8059.39, which contain a race condition in V8 (CWE-362) enabling in-sandbox arbitrary code execution via crafted HTML.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106201
author: valtersit.com
date: 2026/TBD
logsource:
  category: process_creation
  product: windows
detection:
  selection_chrome:
    Image|endswith: '\chrome.exe'
  filter_version:
    - CommandLine|contains: '--headless'
  condition: selection_chrome
fields:
  - Image
  - CommandLine
  - ParentImage
falsepositives:
  - Headless automation and CI browser runs
level: medium

YARA Rule

Hunts for the delivered artifact: HTML/JS pages written to disk (cache, temp) that combine heavy concurrent-timing constructs with obfuscation, consistent with a racing exploit being staged or cached by a compromised browser. This is a behavioral heuristic and does not fingerprint the CVE itself, since no code specifics are public.

rule CVE_2026_106201_V8_Race_Exploit_Heuristic
{
    meta:
        description = "Heuristic detection of staged HTML/JS exploiting a V8 race condition (CVE-2026-106201). No public PoC; logic targets concurrent-timing abuse patterns common to V8 racing exploits."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106201"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $js1 = "Atomics" ascii wide nocase
        $js2 = "SharedArrayBuffer" ascii wide nocase
        $js3 = "postMessage" ascii wide nocase
        $js4 = "WebAssembly" ascii wide nocase
        $js5 = "requestAnimationFrame" ascii wide nocase
        $ob1 = "eval(" ascii nocase
        $ob2 = "unescape(" ascii nocase
        $ob3 = "atob(" ascii nocase

    condition:
        (uint16(0) == 0x3C21 or uint16(0) == 0x6874) and
        (2 of ($js1, $js2, $js3, $js4, $js5)) and
        (1 of ($ob1, $ob2, $ob3))
}

Suricata IDS Rule

No CVE-specific signature is derivable from the available data. The rule below alerts on delivery of JavaScript to clients from a single source hosting race-primitive keywords, useful for catching browser-exploit landing pages in transit. Regex confinement to ASCII and case-insensitivity are applied.

alert http any any -> any any (msg:"CVE-2026-106201 - Potential V8 Race Exploit Landing Page (race primitive keywords in served JS)"; flow:to_client,established; http.response_body; content:"SharedArrayBuffer"; nocase; http.response_body; content:"Atomics"; nocase; http.response_body; content:"WebAssembly"; nocase; threshold:type both, track by_src, count 1, seconds 300; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106201; classtype:web-application-attack; sid:10620101; rev:1;)

Elastic Detection

EQL hunting for interpreter/child processes doing unusual memory-corruption-adjacent activity alongside browser execution — a proxy for in-sandbox code execution on the host. Because the exploit lives in the renderer, host telemetry coverage is limited; the rule targets suspicious browser child-process behavior and crash loops that a racing exploit induces.

sequence by host.id with maxspan=2m
  [process where process.name == "chrome.exe" and process.command_line : "*--type=renderer*"]
  [process where process.parent.name == "chrome.exe" and
     (process.name : ("cmd.exe","powershell.exe","wscript.exe","cscript.exe"))]

Splunk SPL Query

Correlates repeated renderer crashes and unusual browser child-process activity per host, which a race-condition exploit produces during exploitation attempts.

index=endpoint (source="*WinEventLog:Application*" OR source="*Sysmon*")
  (process_name="chrome.exe" OR process_name="chrome")
  (message="*renderer*" OR message="*V8*" OR message="*crashpad*")
| stats count as events, values(message) as details, dc(process_id) as procs by host, user
| where events > 5
| table host, user, events, procs, details

Wazuh OSSEC Rule

Flags browser child-process spawning of script interpreters, consistent with in-sandbox code execution translating into host action.

<group name="cve-2026-106201,chrome,browser,">
  <rule id="106201" level="10">
    <if_sid>59200</if_sid>
    <field name="win.eventdata.parentImage">chrome\.exe</field>
    <field name="win.eventdata.image">\\(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe)$</field>
    <description>CVE-2026-106201 possible: browser spawned a script interpreter (V8 race in-sandbox code execution)</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>cve_2026_106201,exploit_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list is available from the tracked sources. The single concrete remediation known is the version boundary stated in the NVD description.

1) Immediate mitigations.

• Upgrade or allow Chrome to update to 155.0.8059.39 or later wherever possible; that is the only documented fix boundary.