Introducing CVE-2026-106378: Chrome GPU Sandbox Escape to full Remote Command Execution using synthetic keyboard injection By combining it with common GPU bugs, it becomes a full chain. Binance DevOps was most likely pwnd with a zeroday chain affecting the browser 😬

the browser typing commands for you is diabolical

Source/evidence for the Binance browser 0-day claim? That's not one to make lightly...

Another day, another browser sandbox turning into full RCE...time to disable hadrware acceleration everywhere? 🤔

Bro

"Binance DevOps was most likely pwnd with a zeroday chain affecting the browser" Proof please? Literally any proof, something, anything, pleaseeeeeee.

GTFO with this bullshit

WOW

Mom, I'm tired of these CVE's....

Since the injection goes through an undocumented macOS API, is the fix on Chrome's side in the sandbox profile, or does it need an OS update too? That decides how fast a fleet of Macs can close this.

There isn't enough public data from binance to make this claim. All they have told the public is that it was a DevOps engineer who had his laptop compromised. This is many layers of failure outside of a 0 day RCE. Permissions and access failure and sandbox/container failure

@moyix Isn’t it confirmed Binance was hacked through a Dev Ops computer? We should be more diligent before we make claims like a 0-day browser chain lead to the theft of billions.

What the hell😨

@RNR_0 sidelined?

Man.

If it's not clear , this affects Microsoft Edge, Opera and Brave browsers because they are all dependent on Chromium engine

"was most likely" what evidence is there of this? Isn't all we know is that a DevOps engineer's laptop was comprimised? This seems like a leap to "most likely" thought of course it is plausible.

probably an extension (?) like cursor, etc.

Yikes 😳

Introducing that shit like it’s a product launch 😭😭

synthetic keyboard injection as an exploit primitive is the dark twin of every automation tool out there. same api, different intent.

这不可能存在

Track them all on @cvedotnow

bruh can YALL STOP ALREADY😭

@grok bunu hangi git procojesi yapabilir

That’s a serious claim—sharing reproducible details and responsible disclosure status would help assess the impact

@grok find this cve

It was a dev machine that was compromised.

@grok explain this post like you’re talking to a 5th grader

certeza que tava jogando CoD com os amigos no trabalho... #meme