Google Chrome · Disclosed

Chrome 155 fixes GPU sandbox escape on macOS

Oct 30, 2026 · 1 min read

A researcher demonstrated that a sandboxed Chrome GPU process could inject keyboard events on macOS through an undocumented API and run commands, such as opening Calculator. Researcher Paulos Yibelo says the flaw, CVE-2026-106378, is fixed in Chrome 155. No active exploitation is reported; macOS users should update the browser.

By HIFY Radar newsroom Updated 10/30/2026 11:24 AM Get this every day →← Back to the feed 1 source

HighVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A researcher demonstrated that a sandboxed Chrome GPU process could inject keystrokes on macOS and run commands. In the demo, he sent Command+Space, typed "Calculator" and opened the Calculator app. The flaw, CVE-2026-106378, was fixed in Chrome 155.

Why it matters

The sandbox is the barrier that contains malicious code inside the browser. With this escape, that code runs commands on the logged-in user's machine. Anyone using Chrome on macOS is exposed.

What to do

Update Chrome on macOS to version 155 or later. The researcher also recommends updating dependencies that bundle Chrome.

For the technical team

CVE: CVE-2026-106378
Affected: Google Chrome (desktop, sandbox do processo de GPU no macOS) · Google Chrome on macOS, versions prior to 155. The source lists no specific versions.
Exploitation: Technique publicly disclosed by researcher Paulos Yibelo, with a demonstration that opened Calculator. Sources report no active exploitation and no published PoC.
Fix: Update to Chrome 155. The source cites no alternative mitigation.
Vector: Chrome GPU process inside the sandbox on macOS. Sandbox escape: through an undocumented macOS API, the process injects keyboard events (⌘+Space, typing, Return) and runs commands as the user. Requires the attacker to already control the GPU process.
More details: CVE-2026-106378. Disclosed by researcher Paulos Yibelo in a post on X. The demonstration sent ⌘+Space, typed "Calculator" and pressed Return. Sources contain no dates, initial attack chain or attribution.