Google Chrome CVE-2026-106224

Exploitation requires the attacker to FIRST have compromised Chrome's renderer process (e.g., via a separate renderer RCE or sandbox bug) - this is the gating precondition, making the flaw a chained secondary vulnerability rather than a standalone entry point. The victim must then load a crafted HTML page (user interaction, UI:R). The vulnerability lies in a missing authorization check in the Google Lens feature that permits reading cross-origin data. Limiting factors: the mandatory prior renderer compromise, required user interaction to load the malicious page, high attack complexity (AC:H), and impact restricted to low-severity cross-origin data disclosure (no write/integrity or availability effect). Affects Chrome versions prior to 155.0.8059.39; patched builds are not exploitable.

This is a genuinely low-priority issue despite being a browser vulnerability in ubiquitous software. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) yields a base score of 3.1 (Low), and all signals point the same direction: high attack complexity, required user interaction, no integrity or availability impact, and only low (C:L) confidentiality impact limited to cross-origin data disclosure. The single most important mitigating fact is in the description itself - exploitation requires 'a remote attacker who had compromised the renderer process' first, meaning this is a secondary/chained vulnerability useful only after an attacker already holds a foothold inside Chrome's sandboxed renderer, which is itself a significant prerequisite not reflected in the raw score. Note a tension worth stating explicitly: the CVSS vector lists PR:N (no privileges), but the description requires prior renderer compromise - this is consistent with Chromium's threat model (the renderer is treated as untrusted/attacker-controlled), not a contradiction, but defenders should understand PR:N here does NOT mean trivial unauthenticated access. No EPSS score, KEV listing, or POC is provided; exploitation status is therefore 'no public exploit identified at time of analysis.' There is no evidence of active exploitation or weaponization. Overall: a defense-in-depth sandbox-escape-adjacent information leak, not a standalone high-risk threat.

An attacker who has already achieved code execution within Chrome's sandboxed renderer process (via a separate prior exploit) leverages the missing authorization check in Google Lens to read data belonging to other origins, breaking the same-origin policy. The victim must load a crafted HTML page for the flaw to trigger. No public exploit code is identified for this specific issue, and the bug is only useful as one link in a larger exploit chain.