Google Chrome CVE-2026-106231

Exploitation requires the victim to use Google Chrome on macOS at a version prior to 155.0.8059.39 and to load attacker-controlled web content that exercises the Dawn (WebGPU) graphics backend. The key limiting factor is mandatory user interaction (UI:R) - the victim must navigate to the crafted HTML page; there is no drive-by or server-side trigger. Impact is bounded to reading memory outside the sandbox (information disclosure only, C:L), with no code execution, data modification, or denial of service. Non-macOS platforms and patched Chrome builds are unaffected.

This is a moderate, not top-priority, vulnerability despite the 'High' Chromium severity label (which reflects internal triage weight, not real-world risk). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) scores 4.7 (Medium): network-reachable and unauthenticated, but requiring user interaction (UI:R, i.e. the victim must load a malicious page) and yielding only limited confidentiality impact (C:L) with no integrity or availability effect. The S:C (scope change) correctly reflects that an uninitialized Dawn (WebGPU) resource lets an attacker read memory outside the renderer sandbox, but the leak is partial information disclosure, not code execution. All exploitation signals point low: EPSS is 0.23% (12th percentile), the CVE is NOT in CISA KEV, and no public exploit was identified at time of analysis. No SSVC decision data was provided in the input. These signals are mutually consistent - low exploitation probability, no active exploitation, information-only impact - so there is no conflict to reconcile. Net: a real but low-urgency browser flaw; patch via normal Chrome update cadence rather than emergency response.

An attacker hosts or injects a crafted HTML page containing malicious WebGPU/Dawn content and lures a macOS Chrome user to visit it (UI:R). When the page triggers the uninitialized Dawn resource, the attacker reads adjacent process memory from outside the renderer sandbox, potentially leaking sensitive data such as pointers or cross-origin content. No public exploit code was identified at time of analysis, and no active exploitation is confirmed.