Google Chrome CVE-2026-106225

Exploitation requires the victim to be running Google Chrome prior to 155.0.8059.39 and to be socially engineered into opening an attacker-crafted HTML page, which then abuses the Autofill feature's missing authorization check to read sensitive autofill data. Key limiting factors: mandatory user interaction (UI:R) and reliance on social engineering mean this cannot be triggered silently or at scale; SSVC marks it Automatable=no and Technical Impact=partial, and the browser must still have autofill data populated for sensitive information to be exposed.

Real-world risk is MODERATE and lower than the headline CVSS 8.8 suggests. Multiple signals conflict and should be reconciled before prioritization. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) encodes HIGH confidentiality, integrity AND availability impact, but the description only states an attacker can 'obtain sensitive information' - a confidentiality-only outcome - and Google itself rated this 'Chromium security severity: Medium.' The I:H and A:H metrics therefore appear inflated relative to the described impact; this is a likely over-scoring and should be verified against the Chromium issue tracker. All exploitation-maturity signals point LOW: SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial, and there is no KEV listing and no POC provided, so this is no public exploit identified at time of analysis. No EPSS score was supplied, so statistical exploitation probability cannot be weighed. Net: this is a patch-on-normal-cycle browser flaw requiring user interaction and social engineering, not an emergency - the high CVSS is driven by questionable impact metrics rather than demonstrated real-world threat.

An attacker crafts a malicious HTML page and lures a victim (via phishing link, malvertising, or a compromised site) into visiting it with Chrome prior to 155.0.8059.39. Through the Autofill authorization flaw, the page tricks the browser into disclosing sensitive autofill data (e.g., saved form/profile information) to the attacker. User interaction is required (UI:R) and no public exploit code is known at time of analysis.