CVE-2026-78906

A race condition exists in the ANGLE component of Google Chrome prior to revision 152.0.7977.65. The flaw allows a remote attacker to deliver a crafted HTML page that can race access to shared resources, potentially breaking out of the browser sandbox and executing code on the host operating system. The vulnerability is classified as CWE‑362 and its CVSS score of 7.5 indicates high severity, while Chromium security severity is listed as Medium. The consequence of exploitation is loss of process isolation and the possibility of arbitrary code execution outside the sandbox.

The impact is limited to installations of Google Chrome that use the ANGLE graphics backend and are running a stable release earlier than 152.0.7977.65. The vulnerability applies to all user machines with those conditions, regardless of operating system.

The EPSS score is less than 1%, and the vulnerability is not listed in CISA’s KEV catalog, indicating no widespread exploitation has been reported. However, the described race condition can be triggered by a maliciously crafted web page, so the attack vector is inferred to be remote. If an attacker can supply such a page, the sandbox escape would allow them to execute arbitrary code with the privileges of the browser process. The lack of publicly available exploitation cases reduces immediate threat, but the potential for arbitrary code execution and the CVSS score of 7.5 indicating high severity make it a high‑risk issue for end users.