Google Chrome CVE-2026-106214

Exploitation requires the attacker to be on the same adjacent network as the victim (AV:A - not routable from the broader internet) and to deliver crafted network traffic that exercises Chrome's Proxy component on Windows. The HIGH attack complexity (AC:H) means success is not reliable on a single attempt: the attacker must meet additional conditions such as specific timing/race windows or a particular proxy state, which materially limits real-world exploitability. Limiting factors: the attack is confined to Windows builds of Chrome prior to 155.0.8059.39, demands adjacent-network positioning (defeated by network segmentation/isolation), and impact is limited to information disclosure (I:N/A:N) with no code execution or integrity/availability effect. No authentication (PR:N) and no user interaction (UI:N) are required once the attacker is adjacent.

This is a genuinely low-to-moderate real-world priority despite the 'High' Chromium severity label. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N) describes an adjacent-network, unauthenticated attack with HIGH attack complexity, meaning the attacker must be on the same logical network segment AND satisfy difficult conditions (e.g., winning a race or controlling/influencing proxy-relevant network traffic) - this is why the base score lands at only 5.3 even with C:H. Every exploitation signal points to low urgency: SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial, which is internally consistent with the AC:H rating and the information-disclosure-only impact (I:N/A:N). There is no CISA KEV listing and no public POC, so exploitation status is 'no public exploit identified at time of analysis.' Note two tensions to flag explicitly: (1) No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified - do not assume it is high or low. (2) The Chromium 'High' severity reflects Google's internal bug-bounty impact rating and does NOT map to the modest 5.3 CVSS base score; treat the CVSS/SSVC signals as the operative risk indicators. A patch is available, making remediation straightforward via normal Chrome auto-update.

An attacker positioned on the same local/adjacent network as the victim (e.g., shared Wi-Fi, LAN, or a compromised adjacent host) crafts and injects specially formed network traffic that interacts with Chrome's proxy handling on Windows, causing the browser to disclose sensitive information it should not expose. Because attack complexity is High, the attacker must satisfy additional non-trivial conditions (such as specific timing or proxy configuration state) rather than simply sending a single packet. No public exploit code or active exploitation has been identified.