Google Chrome CVE-2026-106230

Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process on Android (an explicit precondition in the description, not something this bug provides), AND that the victim loads a crafted HTML page (UI:R). It is specific to Google Chrome on Android before 155.0.8059.39 and to the Offline component's reference resolution (CWE-706). Limiting factors: the dependency on a pre-existing renderer compromise, the required user interaction, high attack complexity (AC:H), and impact limited to confidentiality (information disclosure only) with no integrity or availability effect sharply narrow realistic exploitation to targeted, multi-stage chains.

This is a genuinely medium-risk, defense-in-depth issue rather than a frontline emergency, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.3) encodes network reach but high attack complexity and required user interaction, and the C:H/I:N/A:N profile means pure information disclosure with no integrity or availability impact. Critically, the description states the attacker must have ALREADY compromised the renderer process - so this is a post-exploitation sandbox/info-leak primitive, not a standalone initial-access bug, which is why CVSS models it as AC:H. The SSVC framework agrees: Exploitation=none (no observed or public exploitation), Automatable=no, Technical Impact=partial - all pointing to 'Track' rather than 'Act'. No EPSS score was provided in the input and the CVE is not on CISA KEV, with no POC referenced, so there is no evidence of active exploitation or available exploit code. The honest read: a Medium-severity Chromium info-leak that is valuable only as one link in a larger exploit chain (it presupposes renderer compromise), so patch it in the normal Chrome update cadence rather than treating it as a zero-day.

An attacker who has already achieved code execution inside Chrome's renderer process (e.g., via a separate renderer RCE) lures the victim to open a crafted HTML page on Chrome for Android, where the incorrect reference resolution in the Offline component leaks sensitive in-process information back to the attacker-controlled page. Because it requires a pre-compromised renderer plus user interaction (UI:R) and has high attack complexity (AC:H), it functions as a sandbox/info-disclosure step in a multi-stage chain rather than a one-shot attack. No public exploit identified at time of analysis.