Google Chrome CVE-2026-106202

Exploitation requires the victim to actively load attacker-controlled content in Chrome - specifically a crafted HTML page that exercises the ANGLE graphics backend (Chrome's OpenGL/WebGL-to-Direct3D translation layer) on Windows, so WebGL/graphics rendering must be reachable (the default in Chrome). The required user interaction (UI:R - the user must navigate to the malicious page) is the primary limiting factor, as is the version constraint: only Chrome builds prior to 155.0.8059.39 on Windows are affected, so patched or auto-updated installs are not exploitable. No authentication is required (PR:N), but the impact is limited to reading memory, not writing or executing.

This is a moderate-severity information-disclosure flaw (CVSS 4.7) rather than a top-tier priority, and the signals are broadly consistent in pointing to lower real-world risk. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) describes a remote, low-complexity, unauthenticated attack that requires user interaction (visiting a crafted page) and yields only low confidentiality impact with no integrity or availability loss; the scope change (S:C) reflects that an uninitialized resource in ANGLE lets a compromised/renderer context read memory outside the Chrome sandbox boundary. EPSS is low at 0.23% (12th percentile), the CVE is NOT on the CISA KEV list, and there is no public exploit identified at time of analysis - all three exploitation signals agree that active, widespread exploitation is not indicated. Chromium rated the underlying bug 'High' severity internally, which reflects the sandbox-boundary memory read, but the external CVSS base score of 4.7 is lower because impact is limited to a partial memory read (no code execution, no write). Net: patch on normal Chrome update cadence; this is a genuine but memory-disclosure-only issue, not a critical RCE, and no data suggests it is being exploited.

An attacker hosts or compromises a web page containing crafted HTML/WebGL content that drives Chrome's ANGLE graphics layer into using an uninitialized resource. When a victim visits the page, the flaw lets the attacker read memory that lies outside the renderer sandbox, potentially leaking sensitive process data such as pointers or tokens useful for defeating ASLR or chaining further exploits. No public exploit code has been identified at time of analysis.