Is CVE-2026-106426 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106426 being exploited in the wild.

How severe is CVE-2026-106426?

Informational severity, published 6 October 2026.

Which products and versions are affected?

Google Chrome before 155.0.8059.39.

Is there a fix for CVE-2026-106426?

Yes: fixed in Chrome 155.0.8059.39 (Windows and Mac), 155.0.8059.39 (Linux). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106426 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-106426?

Check whether you run Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106426: Google Chrome race condition in Fonts sandbox escape

CVE-2026-106426 · Severity: info · Published 2026-10-06

Google Chrome's font handling component contains a race condition that could allow an attacker to escape the browser's sandbox and execute arbitrary code. An attacker could exploit this by crafting a malicious HTML page; successful exploitation would give the attacker the ability to run code with the same privileges as the user's browser.

Technologies: Google Chrome. Vendors: Google.

Quick answers

Is CVE-2026-106426 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106426 being exploited in the wild.
How severe is CVE-2026-106426?: Informational severity, published 6 October 2026.
Which products and versions are affected?: Google Chrome before 155.0.8059.39.
Is there a fix for CVE-2026-106426?: Yes: fixed in Chrome 155.0.8059.39 (Windows and Mac), 155.0.8059.39 (Linux). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106426 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-106426?: Check whether you run Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Chrome 155.0.8059.39 (Windows and Mac), 155.0.8059.39 (Linux)

Technical details

A race condition exists in the Fonts component of Chromium prior to version 155.0.8059.39, allowing a remote attacker to bypass the sandbox via a crafted HTML page. The vulnerability is triggered through network-based attack vector with user interaction (user must visit a malicious page). Successful exploitation results in arbitrary code execution outside the sandbox, effectively breaking the browser's security isolation model.

Affected products

Google Chrome before 155.0.8059.39

Timeline

2026-10-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.