Google Chrome CVE-2026-106206

Exploitation requires the target to be running Google Chrome on iOS at a version prior to 155.0.8059.39, and the attacker must be able to deliver or influence network traffic that reaches the browser's mobile input-validation path (such as an attacker-controlled server or a man-in-the-middle/on-path position). No authentication (PR:N) and no user interaction (UI:N) are needed. The key LIMITING factor is high attack complexity (AC:H): success depends on specific memory state or timing/race conditions rather than a deterministic request, and impact is restricted to information disclosure (no code execution, no integrity or availability effect). Desktop and non-iOS Chrome builds are outside the stated scope.

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9) describes a network-reachable, unauthenticated, no-interaction information-disclosure flaw, but tempers it with high attack complexity (AC:H) - meaning the attacker must win a race, rely on specific memory/traffic conditions, or meet non-trivial preconditions rather than firing a single reliable exploit. Impact is confidentiality-only (C:H, I:N, A:N): no code execution, no integrity or availability loss. No EPSS score was supplied, so exploitation probability cannot be quantified; it is NOT in CISA KEV and NO public PoC is referenced, so this is 'no public exploit identified at time of analysis.' Google rates the Chromium severity as Medium, which is consistent with the info-leak scope and AC:H. Note a data conflict worth verifying: the description scopes this to 'Google Chrome on iOS' (Mobile component), yet the supplied CPE is a generic 'cpe:2.3:a:google:chrome:*' with no platform constraint, and the reference URLs are Chrome *desktop* stable-channel posts - confirm the iOS-specific fixed build (155.0.8059.39) against Google's iOS release notes. Overall: patch in normal cycle; not an emergency given AC:H, Medium rating, confidentiality-only impact, and absence of exploitation signals.

A remote attacker positioned to deliver or influence network traffic to a Chrome-for-iOS user (e.g. via a malicious or attacker-controlled server, or a man-in-the-middle position) sends crafted responses that the mobile input-validation logic mishandles, causing the browser to disclose sensitive in-memory or cross-context information back to the attacker. The high attack complexity (AC:H) means success depends on favorable timing or memory conditions rather than a deterministic single request, and no public exploit code is currently known.