1.
How an allowed WindowServer connection and inherited macOS event-posting permission let Chrome’s sandboxed GPU process inject keystrokes and launch apps outside the sandbox.
Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-106378.