Google Chrome CVE-2026-106221

Exploitation requires the victim to be running Google Chrome on Android at a version prior to 155.0.8059.39 and to be socially engineered into opening an attacker-crafted HTML page (UI:R), so it cannot occur silently or server-side. The flaw lives specifically in WebAPK handling, meaning installed Progressive Web App / WebAPK functionality is the relevant surface; the attack abuses a confused deputy to act under another web origin's authority. Limiting factors: mandatory user interaction, Android-only Chrome, pre-patch versions only, and reliance on successful social engineering - these substantially reduce real-world exploitability despite the high nominal CVSS. No authentication is required (PR:N).

Signals conflict sharply and must be reconciled before prioritizing. The input CVSS base score is 8.3 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L, implying a network-reachable, unauthenticated, low-complexity issue with high confidentiality and integrity impact. However, Google/Chromium themselves rated this a LOW severity issue, and the bug class - CWE-441 confused deputy resulting in a web-origin-policy (same-origin policy) bypass in WebAPKs - is a sandbox/boundary weakness rather than direct remote code execution, which explains the vendor downgrade. Exploitation requires user interaction (UI:R) driven by social engineering plus a crafted HTML page, so it is not a drive-by, wormable, or server-side flaw. EPSS is 0.22% (12th percentile), i.e. low predicted exploitation probability, and there is no public exploit identified at time of analysis and no CISA KEV listing. Net assessment: the raw 8.3 overstates real-world urgency; the combination of vendor LOW rating, mandatory user interaction, low EPSS, and absence of KEV/POC makes this a routine browser patch-hygiene item rather than an emergency. The CVSS-vs-vendor-severity discrepancy should be noted explicitly - treat the C:H/I:H claim with caution, as an origin-policy bypass typically yields cross-origin data exposure rather than full integrity compromise.

An attacker lures an Android Chrome user (via phishing link, malvertising, or a messaging lure) to a crafted HTML page. The page abuses the WebAPK confused-deputy flaw so that an action is performed under a different web origin's authority, bypassing same-origin protections to access or influence data belonging to another site the victim trusts. No public exploit code is known, and successful attack depends on the victim visiting the attacker-controlled page.