CVE-2026-106377

Executive Summary

CVE-2026-106377 is a high-severity race condition vulnerability in the font handling subsystem of Google Chrome versions prior to 155.0.8059.39. A remote attacker who has already compromised the renderer process can exploit this race condition to execute arbitrary code outside the browser sandbox. With a CVSS score of 8.3, this vulnerability poses significant risk to enterprises relying on Chrome as their primary browser, as it enables sandbox escape and full system compromise.

Technical Analysis

This vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), commonly known as a race condition. The flaw resides in Chrome's font processing component, which manages the loading, parsing, and rendering of font resources within the browser.

Race conditions occur when multiple threads or processes access shared resources without proper synchronization, leading to unpredictable behavior. In the context of Chrome's font subsystem, this likely involves concurrent operations on font data structures — such as font cache manipulation, font parsing state, or memory allocation for glyph rendering. When timing is manipulated by an attacker, the race condition can corrupt memory, leading to use-after-free or out-of-bounds access conditions.

The critical aspect of this vulnerability is its position in the attack chain. The NVD description explicitly states the attacker must have "compromised the renderer process" before exploiting this flaw. This means CVE-2026-106377 is a sandbox escape primitive — it is the second stage of a multi-stage exploit chain. The renderer process in Chrome runs in a restricted sandbox with limited privileges. By exploiting this race condition, an attacker can break out of that sandbox and execute code with the privileges of the browser process, which runs outside the sandbox.

The attack vector is network-based (AV:N) but requires user interaction (UI:R) — the victim must visit a crafted HTML page. The high attack complexity (AC:H) reflects the difficulty of reliably winning a race condition, which typically requires precise timing and multiple attempts. The scope change (S:C) indicates the vulnerability allows an attacker to impact resources beyond the vulnerable component's security scope, consistent with a sandbox escape. The confidentiality, integrity, and availability impacts are all rated High (C:H/I:H/A:H), meaning successful exploitation could result in complete compromise of the affected system.

The font processing attack surface is particularly attractive to attackers because fonts are complex binary formats that require extensive parsing. The browser must handle numerous font formats (TrueType, OpenType, WOFF, WOFF2, etc.) and process them efficiently for rendering. This complexity creates opportunities for memory corruption bugs. The race condition specifically suggests that the vulnerability involves concurrent font operations — possibly related to web font loading, where multiple fonts are loaded asynchronously while rendering occurs concurrently.

Chrome's multi-process architecture normally provides defense in depth: the renderer process is sandboxed, and even if compromised, it should not be able to affect the rest of the system. This vulnerability defeats that defense by allowing code execution outside the sandbox. The fact that the attacker must first compromise the renderer means that exploitation requires a separate vulnerability (a renderer RCE) to be chained with this one. However, once both are available, the impact is severe — full system compromise via a web page.

The CVSS vector highlights that no privileges are required (PR:N) and no special access conditions exist beyond the user visiting a page. The attack complexity being High is the primary mitigating factor that keeps the score at 8.3 rather than higher.

Exploitation Scenarios

No public PoC available; attack chain is inferred from vulnerability class.

1. Reconnaissance/Target Identification: An attacker identifies targets via phishing campaigns, malicious advertisements, or compromised websites. The goal is to lure victims to a crafted HTML page. The attacker may target specific organizations or use broad targeting. No specific reconnaissance of the victim's system is required beyond confirming they use a vulnerable Chrome version.

2. Triggering the Race Condition: The attacker must first compromise the renderer process. This requires an initial vulnerability — either a separate renderer RCE or a technique to gain code execution within the renderer. Once the renderer is compromised, the attacker crafts an HTML page that triggers the font processing race condition. This likely involves loading multiple fonts concurrently or manipulating font loading timing to cause concurrent access to shared font resources. The crafted HTML page would contain JavaScript and font resources designed to create the precise timing conditions needed to win the race. The attacker may use techniques such as repeatedly loading and unloading fonts, using web workers to increase concurrency, or exploiting font parsing quirks.

3. Payload/Execution: By winning the race, the attacker causes memory corruption in the font subsystem. This corruption is leveraged to bypass the sandbox. The exact exploitation primitive (e.g., use-after-free, type confusion) is not specified in the available data. The attacker would use the corruption to gain arbitrary read/write within the browser process context, then execute a payload outside the sandbox. The payload could be shellcode or a ROP chain that disables the sandbox or directly executes system commands.

4. Post-Exploitation Impact: Once outside the sandbox, the attacker has code execution at the privilege level of the Chrome browser process (typically the user's privilege level). From there, the attacker can install persistence, exfiltrate data, move laterally within the network, or deploy ransomware. The impact is complete system compromise from the user's perspective.

Impact Assessment

Successful exploitation of CVE-2026-106377 results in arbitrary code execution outside the Chrome sandbox. This means an attacker can fully compromise the victim's system, leading to data theft, ransomware deployment, espionage, or further lateral movement within an enterprise network.

The CVSS score of 8.3 reflects high impact across confidentiality, integrity, and availability. The scope change indicates the vulnerability affects resources beyond the browser's security boundary. The attack complexity is high, requiring the attacker to first compromise the renderer and then reliably win a race condition — a non-trivial task. However, as demonstrated by past Chrome exploits, sophisticated attackers (including nation-state actors and commercial spyware vendors) routinely chain such vulnerabilities.

Enterprises using Google Chrome as their primary browser are at risk. The blast radius includes any system where a user visits a malicious page with a vulnerable Chrome version. Given Chrome's widespread adoption (over 60% market share), the potential impact is enormous. Critical infrastructure, financial services, healthcare, and government organizations are prime targets.

The lack of a CISA KEV listing and no known public exploit activity does not eliminate risk — it may simply mean exploitation has not been detected or disclosed. High-value targets should treat this as a critical priority.

Detection Guidance

Sigma Rule

title: Chrome Font Race Condition Exploitation Attempt
id: 7a3f9e21-4b8c-4d5e-9f1a-2c3d4e5f6a7b
status: experimental
description: Detects potential exploitation of CVE-2026-106377 race condition in Chrome Fonts subsystem
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106377
author: Threat Intelligence Team
date: 2026/05/20
tags:
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
  selection_child_suspicious:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  filter_legit:
    CommandLine|contains:
      - '--type=renderer'
      - '--type=gpu-process'
  condition: selection_parent and selection_child_suspicious and not filter_legit
falsepositives:
  - Legitimate browser extensions launching external applications
  - Enterprise application launching from browser context
level: high

YARA Rule

rule CVE_2026_106377_Chrome_Font_Race_Condition
{
    meta:
        description = "Detects potential exploitation of CVE-2026-106377 race condition in Chrome Fonts"
        author = "Threat Intelligence Team"
        date = "2026-05-20"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106377"
        severity = "high"

    strings:
        $font_magic_ttf = { 00 01 00 00 00 }
        $font_magic_otf = { 4F 54 54 4F }
        $font_magic_woff = { 77 4F 46 46 }
        $race_indicator1 = "fontLoader" ascii wide nocase
        $race_indicator2 = "loadFont" ascii wide nocase
        $race_indicator3 = "FontFace" ascii wide nocase
        $suspicious_js1 = "while(true)" ascii wide
        $suspicious_js2 = "requestAnimationFrame" ascii wide

    condition:
        (uint32(0) == 0x00010000 or uint32(0) == 0x4F54544F or uint32(0) == 0x774F4646) and
        any of ($race_indicator*) and
        any of ($suspicious_js*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106377 Chrome Font Race Condition Exploitation Attempt"; flow:established,to_client; content:"Content-Type"; http_header; content:"font"; http_header; content:"|00 01 00 00|"; within:16; distance:0; pcre:"/font-face|FontFace|woff|woff2/i"; threshold:type both, track by_src, count 5, seconds 10; classtype:attempted-user; sid:9000031; rev:1; reference:cve,2026-106377; metadata:affected_product Chrome, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2026_05_20, updated_at 2026_05_20;)

Elastic Detection

process where event.type == "start" and
  process.parent.name == "chrome.exe" and
  process.name in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe") and
  not process.parent.command_line : "*--type=renderer*" and
  not process.parent.command_line : "*--type=gpu-process*"

Splunk SPL Query

index=main sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:Sysmon EventCode=1
| search ParentImage="*\\chrome.exe" 
| search Image IN ("*\\cmd.exe","*\\powershell.exe","*\\wscript.exe","*\\cscript.exe","*\\rundll32.exe","*\\regsvr32.exe","*\\mshta.exe")
| search CommandLine="*font*" OR CommandLine="*FontFace*" OR CommandLine="*woff*"
| stats count values(CommandLine) as commands by Computer, User, ParentCommandLine
| where count > 0

Wazuh OSSEC Rule

<group name="windows,sysmon,">
  <rule id="100310" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">\\chrome\.exe$</field>
    <field name="win.eventdata.image">\\(cmd|powershell|wscript|cscript|rundll32|regsvr32|mshta)\.exe$</field>
    <field name="win.eventdata.parentCommandLine" negate="yes">--type=renderer</field>
    <field name="win.eventdata.parentCommandLine" negate="yes">--type=gpu-process</field>
    <description>CVE-2026-106377: Suspicious child process spawned from Chrome - possible sandbox escape exploitation</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Upgrade Google Chrome to version 155.0.8059.39 or later immediately. Given the high severity and sandbox escape potential, this should be treated as emergency patching.
   • Enable Chrome's automatic update mechanism and verify version compliance across the fleet.
   • If immediate patching is not possible, consider temporarily restricting access to untrusted websites or implementing application allowlisting that prevents Chrome from launching child processes outside expected browser behavior.
   • Enable Chrome's Site Isolation feature (enabled by default in modern versions) to strengthen process boundaries.
   • Deploy endpoint detection and response (EDR) rules to monitor for suspicious child processes spawned by Chrome.
   • Consider disabling the font rendering of remote web fonts via browser policy if operationally feasible (may impact user experience).

2. Patch/Upgrade Steps:

   • Navigate to chrome://settings/help or use enterprise deployment tools (e.g., Google Update, SCCM, Intune) to push version 155.0.8059.39.
   • Verify version after upgrade via command line: chrome --version or registry query.
   • For enterprise environments, use Chrome Browser Cloud Management to force update policies.
   • Confirm Chromium-based browsers (Edge, Brave, Opera) release corresponding updates and patch those as well.

3. Long-Term Hardening:

   • Implement a vulnerability management program with automated patching SLAs for browsers (e.g., critical patches within 72 hours).
   • Enable Chrome's sandbox (default) and verify it has not been disabled via policy.
   • Enforce browser hardening baselines: disable unnecessary plugins, block untrusted font sources, enable enhanced safe browsing.
   • Deploy network-level inspection for malicious font payloads and exploit kits.
   • Conduct regular penetration testing that includes browser exploit chains.
   • Monitor CISA KEV and vendor advisories for this CVE; prioritize if exploitation is observed.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106377
• Google Chrome Release Notes: https://chromereleases.googleblog.com/ (search for version 155.0.8059.39)
• Chromium Security Severity Guidelines: https://www.chromium.org/developers/severity-guidelines/
• MITRE CWE-362: https://cwe.mitre.org/data/definitions/362.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (currently no listing for CVE-2026-106377)