CVE-2026-106378(apple / chrome)

Introducing CVE-2026-106378: Chrome GPU Sandbox Escape to full Remote Command Execution using synthetic keyboard injection By combining it with common GPU bugs, it becomes a full chain. Binance DevOps was most likely pwnd with a zeroday chain affecting the browser 😬 https://t.co/h87aosIwvm

Escaping Chrome's GPU sandbox through an undocumented macOS API. Discovered a sandboxed Chrome GPU process could inject keyboard events so sent ⌘+Space, typed "Calculator" & hit Return 😂. CVE-2026-106378 is fixed in Chrome 155. Update chrome dependancies. Happy Octoberfest.

Chrome sandbox escape to full remote command execution. A newly disclosed vulnerability, CVE-2026-106378, reportedly allows Chrome’s sandboxed GPU process to escape isolation through macOS keyboard-injection capabilities. The researcher describes a chain that can turn the sandbox escape into full RCE. The key issue: browser sandboxing is only as strong as the isolation boundaries protecting the underlying OS. October has been a brutal month for cybersecurity.

Chrome'da CVE-2026-106378: GPU Sandbox Escape ve synthetic keyboard injection kullanılarak tam RCE elde edilmesi, yaygın GPU açıklarıyla birleştirildiğinde ise tam bir exploit chain oluşturulabilmesi .. Bu açık Chrome 155.0.8059.39 sürümünde yamalandı. PoC sahibi: @pwn_ai https://x.com/pwn_ai/status/2116172656084979725/video/1

🚨 A Chrome macOS sandbox escape exposes desktop input. CVE-2026-106378 lets compromised GPU processes inject keyboard events through WindowServer, potentially launching apps outside the sandbox. Chaining bugs could enable code execution. 🔎 https://exploitgrid.net

🚨 Mac 上的 Chrome 有个沙箱逃逸，能伪造你敲键盘，打开终端执行命令 编号 CVE-2026-106378，是真的，Google 10 月 6 号已经修了 先讲人话： 浏览器把网页关在一个笼子里跑，这叫沙箱 这个洞是笼子里负责画图的 GPU 进程，能找系统要「假键盘」 程序伪造你在敲键盘：Cmd+空格 → 输入程序名 → 回车 计算器、终端就这么被「你」打开了 我核到的： 🔹 只影响 Mac，Chrome 155.0.8059.39 之前的版本 🔹 Chromium 官方评级 Medium，CISA 打分 8.3 🔹 研究员的 writeup 和 PoC 都公开了，演示是弹出计算器 🔹 Google 没报在野利用 但别被标题吓到： 🔹 前提是攻击者已经先拿下了浏览器内部进程 🔹 它是利用链的后半段，单靠打开一个网页触发不了 🔹 还要满足系统权限条件（辅助功能授权这类） 网传币安这次被盗，就是被这类浏览器 0day 链打的 这是作者猜测，没有实锤 币安官方目前只说「疑似一名 DevOps 的笔记本被攻破」 笔记本怎么被攻破的还没公布，官方会出技术复盘 做渗透的角度说一句： 员工电脑才是真正的入口，一台电脑能碰到的权限越多，越危险 防护： 🔹 地址栏打开 chrome://settings/help，更新到最新（现在是 156），然后重启浏览器 🔹 系统设置 → 隐私与安全 → 辅助功能，不认识的授权全关掉 🔹 管着生产权限的电脑，别拿来乱点链接

Audit and remediate outdated browser automation on this Mac, including the macOS Chrome GPU sandbox / inherited Accessibility permission issue associated with CVE-2026-106378. Proceed with targeted, reversible local fixes. Preserve unrelated work and running user sessions. 1. Verify the advisory and current fixes using primary sources: Chromium/Chrome security advisories, the research disclosure, and official Playwright/Puppeteer documentation. Determine the fixed full browser versions. A major version number or “latest Playwright” alone is insufficient evidence that a browser has current security patches. 2. Inventory the automation tools actually installed or configured here: - Playwright and Puppeteer in global packages, Python environments, active projects, npx caches, MCP servers, and agent/IDE-managed runtimes. - Browser caches, including ~/Library/Caches/ms-playwright and ~/.cache/puppeteer, plus custom paths and bundled browsers. - Relevant launch settings, executable overrides, browser channels, and sandbox-disabling flags. Keep discovery focused on configured tools and active projects. Avoid exhaustive scans of archived repositories or historical artifacts. Never print credentials or sensitive configuration values. 3. Trace each tool to the browser executable it would actually launch. Record: - Owning tool/environment and package version. - Executable path and full browser version. - Whether that executable is installed, selected by configuration, or currently running. - Whether the owner is user-managed or vendor-managed. Distinguish package targets, cached binaries, and running browsers. Check relevant Accessibility permission context where ordinary access permits; do not bypass macOS privacy controls. 4. Remediate user-managed tools: - Upgrade the owning automation package and install its supported patched browser using the existing package manager. - Preserve intentional dependency constraints; investigate compatibility before overriding them. - Where supported and appropriate, consider using current installed Chrome through an explicit browser channel or executable setting. - Verify that the selected browser contains the required security fixes, including current patch updates. - Keep unrelated dependency upgrades out of scope. For vendor-managed agent runtimes, use the supported updater or configuration mechanism. Do not hand-edit bundled dependencies or replace browser binaries under old cache revision names. If a vendor runtime cannot be fixed locally, report the exact blocker and a supported interim mitigation. 5. Verify each changed consumer with a harmless browser launch and representative smoke test. Report the browser version returned by the launched browser and its executable path. Run relevant project checks. Restart only processes you own; coordinate any restart that would interrupt user work. 6. Retire obsolete browser caches only after confirming their consumers have migrated. Preserve required Accessibility grants and identify unnecessary grants for review. Do not run exploit demonstrations. Finish with a compact before/after table, changes made, verification results, and remaining blockers. Leave repository changes uncommitted. Do not push or deploy.

https://www.cve.org/CVERecord?id=CVE-2026-106378 https://pwn.ai/blog/chrome-escape

Một nhà nghiên cứu bảo mật vừa công bố thông tin về CVE-2026-106378, lỗ hổng được cho là có khả năng thoát khỏi GPU Sandbox của Google Chrome thông qua kỹ thuật giả lập thao tác bàn phím (synthetic keyboard injection). Theo công bố, khi kết hợp với các lỗ hổng GPU khác, chuỗi khai thác có thể dẫn đến Remote Code Execution (RCE), cho phép kẻ tấn công thực thi mã trên máy nạn nhân. Đáng chú ý, tác giả cũng nhận định vụ tấn công nhằm vào Binance DevOps trước đây có thể đã sử dụng một chuỗi zero-day tương tự. Tuy nhiên, đây chưa phải thông tin được Google hoặc Binance xác nhận chính thức. Nếu được xác minh, đây sẽ là một trong những chuỗi khai thác trình duyệt nguy hiểm nhất năm 2026. Người dùng và doanh nghiệp nên cập nhật Chrome ngay khi có bản vá và hạn chế truy cập các website không rõ nguồn gốc.

🚨 #CVE-2026-106378: How Chrome’s #macOS GPU Sandbox Allowed Fake Keystrokes via WindowServer + Video -Prediction: 📈 1 Positive | 📉 2 Negative https://undercodetesting.com/cve-2026-106378-how-chromes-macos-gpu-sandbox-allowed-fake-keystrokes-via-windowserver-video/ Educational Purposes!