Google Chrome CVE-2026-106205

Exploitation requires the attacker to have ALREADY compromised Chrome's renderer process on Android (the description states this as a precondition); from that foothold the attacker uses a crafted HTML page to bypass site isolation and reach the Passwords component via the missing authorization check. Limiting factors: this is a second-stage/chained vulnerability - it cannot be triggered by an unprivileged remote attacker without first achieving renderer code execution; user interaction is required (UI:R, loading the crafted page); and it is specific to Google Chrome on Android prior to 155.0.8059.39. These factors substantially lower realistic risk relative to the 8.1 base score.

Signals point consistently toward a LOW real-world priority despite the 8.1 'High' CVSS base score. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) drives the high number via network vector and high confidentiality/integrity impact, but this understates a critical precondition stated in the description: the attacker must have ALREADY compromised the renderer process. This is a second-stage sandbox/site-isolation escape, not a standalone remote exploit - the PR:N metric is therefore misleading because meaningful attacker capability (renderer code execution) is a prerequisite not captured in the vector. CVSS AV:N but description implies the bug is only reachable from an already-compromised renderer - verify exploitation context with vendor. Supporting signals align with low urgency: EPSS is 0.21% (11th percentile), there is no CISA KEV listing, and SSVC reports Exploitation=none and Automatable=no (only Technical Impact=total is elevated, consistent with full password disclosure once chained). No public exploit code is identified. Chromium itself rated this only Medium severity, which better reflects the chained/second-stage nature than the 8.1 base score. Net: a legitimate security fix to deploy via normal Chrome auto-update, but not an emergency given no exploitation evidence and a high capability bar.

An attacker who has already achieved code execution in Chrome's renderer process on an Android device (e.g., via a separate renderer RCE bug) serves a crafted HTML page that abuses the missing authorization check to bypass site isolation. This lets the compromised renderer reach password data it should be partitioned from, enabling theft of stored credentials. No public exploit code is identified at time of analysis, and the attack requires chaining with a prior renderer compromise (UI:R, AC:L).