Google Chrome CVE-2026-106180

Exploitation requires the victim to actively load an attacker-controlled HTML page (UI:R) that embeds cross-origin content and triggers the Animation observable-discrepancy side channel. The key LIMITING factors are: high attack complexity (AC:H) because the attacker must exploit a timing/rendering discrepancy that typically needs favorable conditions and repeated measurement to extract usable data; the impact is confined to a limited cross-origin information leak (C:L, I:N, A:N) with no code execution, data modification, or denial of service; and the victim must be running a Chrome version prior to 155.0.8059.39. No special non-default browser configuration is required.

This is a low-priority, low-real-risk issue despite being a browser vulnerability in an ubiquitous product. The CVSS 3.1 base score is 3.1 (Low), and the vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) is internally consistent with the description: network-reachable but requiring high attack complexity (characteristic of the timing/observable-discrepancy side channel in CWE-203), user interaction (victim must load a crafted page), no privileges, unchanged scope, and only low confidentiality impact with no integrity or availability effect. All exploitation signals agree on low urgency: CISA SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial, which matches the single-origin, low-confidentiality leak. There is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation. EPSS is not provided in the input and cannot be factored in. The one minor caveat is the AC:H designation - observable-discrepancy leaks often require favorable timing conditions and many repeated observations to extract meaningful cross-origin data, so real-world data exfiltration is slow and situational rather than a clean read. Overall this is a defense-in-depth patch, not an emergency.

An attacker lures a victim into visiting a malicious web page that embeds cross-origin content and uses crafted CSS/Web Animations to measure an observable discrepancy (e.g., timing or rendering side effects) and infer cross-origin data the page should not be able to read. Because UI:R and AC:H apply, the victim must actively load the attacker's page and the attack depends on favorable conditions and repeated measurement. No public exploit code has been identified at time of analysis.