Chrome Sandbox Escape Vulnerability Enables Full Remote Code Execution
Security researchers have disclosed CVE-2026-106378, a Chrome for macOS GPU sandbox escape: the sandboxed GPU process could reach WindowServer and inject keystrokes, and the proof of concept used this to open Spotlight and launch Calculator outside the sandbox. The flaw was fixed in Chrome 155. The wider risk is not regular Chrome, which updates automatically, but older Playwright Chromium builds bundled inside AI tools such as Cursor and Claude Code, which can inherit the IDE accessibility permissions.
SOURCES
- LinuxDo2026-10-31 01:07