Google Chrome CVE-2026-106208

Exploitation requires the victim to install and run an attacker-crafted Chrome extension on a Chrome version prior to 155.0.8059.39; the flaw is a missing authorization check (CWE-862) on a Chrome API that the malicious extension then calls to access data it should not reach. Limiting factors are significant: mandatory user interaction (UI:R) to accept and install the extension, reliance on successful social engineering, local execution context (AV:L) rather than direct network reachability, and dependence on an unpatched Chrome build - patched (>=155.0.8059.39) or auto-updated browsers are not affected.

Signals are consistently moderate and do not elevate this to a top-priority issue. The CVSS 3.1 vector scores 6.1 (Medium) and Chromium itself rated it Medium. EPSS is very low at 0.19% (8th percentile), there is no CISA KEV listing and no public POC identified, so exploitation is neither confirmed nor imminent. The CVSS vector is AV:L (local) with UI:R and PR:N, meaning exploitation hinges on a victim being socially engineered into installing and running a crafted malicious Chrome extension - not on unauthenticated remote packet delivery. NOTE A CONFLICT: the description calls this 'a remote attacker leveraging social engineering' while the CVSS vector encodes AV:L; the 'remote' framing refers to the attacker's position during extension delivery, but the actual exploitation requires local execution context via the installed extension. Impact is information disclosure (C:H) with limited integrity effect (I:L) and no availability impact. Overall this is a real-but-modest risk: patch in normal cycles rather than emergency, prioritized above purely theoretical bugs because Chrome's footprint is enormous but below any actively-exploited or network-wormable flaw.

An attacker publishes or distributes a crafted Chrome extension and uses social engineering (e.g., a convincing listing or phishing lure) to persuade a victim to install it on a vulnerable Chrome build before 155.0.8059.39. Once installed and active, the extension abuses a missing authorization check in a Chrome API to read sensitive information it should not be permitted to access. No public exploit code has been identified at time of analysis, and the attack requires user interaction to install the extension.