Google Chrome CVE-2026-106182

Exploitation requires the victim to actively load an attacker-crafted HTML page in a vulnerable Chrome build (any version before 155.0.8059.39) - this mandatory user interaction (UI:R) is the primary limiting factor. No authentication, special privileges, or non-default configuration is required on the victim side (PR:N), and the flaw is reachable against default Chrome installations. The practical ceiling on impact is that the outcome is UI deception/spoofing only (CWE-451), not code execution or direct data compromise, so success further depends on the user being fooled by the spoofed interface into taking an unsafe action.

This is a genuinely low-priority issue despite its network attack vector. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, score 5.4) describes a remotely reachable, low-complexity, unauthenticated flaw, but exploitation requires user interaction (UI:R - the victim must visit an attacker-crafted HTML page) and the impact is limited to UI spoofing (CWE-451, UI misrepresentation), not code execution or meaningful data theft. All exploitation signals point the same direction and reinforce low risk: CISA's SSVC decision framework records Exploitation=none, Automatable=no, and Technical Impact=partial, which maps to a 'Track' (not 'Act') posture. There is no CISA KEV listing and no public proof-of-concept identified in the provided data, and EPSS was not supplied. The signals are therefore consistent rather than conflicting. One caveat worth flagging for verification: the CVSS Availability impact (A:L) is unusual for a pure UI-spoofing/misrepresentation weakness, which typically carries no availability impact - this looks like a scoring artifact and does not change the low real-world priority. Chromium itself rated this 'Medium' severity.

An attacker hosts a malicious web page and lures a Chrome user (versions prior to 155.0.8059.39) to visit it. The page uses the Paint component flaw to render deceptive UI elements - for example spoofing browser chrome, dialogs, or security indicators - tricking the victim into trusting attacker-controlled content. No public exploit code was identified in the provided data, and the attack cannot proceed without the victim actively loading the crafted page.