Google Chrome CVE-2026-106210

Exploitation requires the victim to install a crafted (attacker-controlled) Chrome extension, and is limited to Chrome versions prior to 155.0.8059.39 on the desktop stable channel. The user-interaction requirement (installing/running the malicious extension) and high attack complexity (AC:H) are the primary limiting factors; the flaw cannot be triggered by merely visiting a web page without the malicious extension present. Impact is confined to disclosure of cross-origin data (C:L) with no integrity or availability effect. Auto-update further limits the exposure window.

This is a genuinely low-priority issue despite affecting a ubiquitous product. The CVSS 3.1 base score is only 3.1 (Low), driven by a network vector (AV:N) but tempered by high attack complexity (AC:H), required user interaction (UI:R), and limited confidentiality impact only (C:L/I:N/A:N). All exploitation signals point the same direction and are mutually consistent: SSVC reports Exploitation 'none', Automatable 'no', and Technical Impact 'partial', which aligns with the low CVSS and the limited C:L impact. There is no CISA KEV listing and no public exploit code referenced in the input, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be cross-referenced. The key real-world limiter is that exploitation requires a crafted (malicious) Chrome extension to be installed, which is a high bar and inconsistent with casual mass exploitation. Chromium itself rated this 'Medium' severity, slightly above the NVD 3.1 Low; this is a modest, expected discrepancy and not a conflict worth escalation. Net assessment: a high-prevalence product but a low real-risk, information-disclosure-only flaw - patch via normal browser-update cadence rather than emergency response.

An attacker publishes or convinces a victim to install a crafted Chrome extension that abuses an observable timing/behavioral discrepancy in Chrome's scroll handling to infer cross-origin data the extension should not be able to read. Because the browser auto-updates, the window of exposure is narrow, and no public exploit code is referenced. The high attack complexity (AC:H) and need for the user to install the extension (UI:R) make opportunistic exploitation unlikely.