Google Chrome CVE-2026-106209

Exploitation requires a victim running Google Chrome for iOS at a version prior to 155.0.8059.39 to actively open an attacker-crafted HTML page (UI:R) after being socially engineered into doing so - the flaw cannot be triggered without this victim action. No authentication is required (PR:N), and default configurations are affected, but the dependence on social engineering and the absence of automation (SSVC Automatable=no) significantly limit realistic, large-scale exploitation. The impact is deceptive address-bar spoofing enabling phishing, not direct system compromise.

This is a genuinely low-to-moderate real-world risk despite the MEDIUM rating. Multiple signals agree: the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, score 5.4) reflects a network-reachable but user-interaction-dependent flaw with only low confidentiality/availability impact and no integrity impact, consistent with a UI-spoofing (CWE-451) weakness rather than code execution. CISA's SSVC framework corroborates low priority: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS was not provided in the input, so exploitation probability cannot be quantified. The attack requires social engineering plus active victim interaction, so even though the attack vector is network (AV:N), real exploitation is targeted and manual rather than scalable. One caveat: the vendor-supplied vector includes A:L (low availability impact), which is a questionable fit for an address-bar spoof - this appears to be Chrome's conservative default scoring rather than a true availability effect. Net: a real but modest issue best handled through routine patching, not emergency response.

A remote attacker crafts a malicious HTML page and uses social engineering (e.g., a phishing link) to lure a Google Chrome for iOS user into opening it. The page manipulates the browser so the address bar displays a trusted/legitimate domain while attacker-controlled content is shown, tricking the victim into trusting a fraudulent page. No public exploit code or active exploitation is known; exploitation depends on user interaction (UI:R).