Google Chrome CVE-2026-106241

Requires the victim to be running Google Chrome on Android at a version prior to 155.0.8059.39 and to be socially engineered into opening an attacker-crafted HTML page (UI:R) - exploitation cannot occur without this user interaction, which is the primary limiting factor. The flaw resides in the Search component's incorrect authorization handling (CWE-863); no authentication or special privileges are needed on the attacker side (PR:N), and the device need not be in a non-default configuration. Exploitation is limited to the Android platform and does not affect desktop builds; the required social-engineering step and single-click interaction meaningfully constrain realistic exploitability despite the network attack vector.

Signals conflict and must be weighed carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6 Critical) describes a network-reachable, low-complexity, unauthenticated sandbox escape with full confidentiality/integrity/availability impact and a scope change - on paper a top-priority flaw. However, Google's own Chromium security team rated this only 'Medium', and the description uses hedged language ('potentially execute arbitrary code'), so the 9.6 is likely an inflated numeric mapping of a bug the vendor considers less severe in practice - treat the headline score with skepticism and prioritize the vendor rating. Crucially, exploitation requires user interaction (UI:R) driven by social engineering, which materially lowers real-world likelihood versus a drive-by with no interaction. No EPSS score was provided, so exploitation probability cannot be quantified; the CVE is not in CISA KEV and no public exploit code was identified, so there is no evidence of active or imminent exploitation. Net assessment: a patch-worthy browser bug whose theoretical impact is high but whose realistic risk is tempered by the required user interaction, the vendor's Medium rating, and the absence of any exploitation signal (KEV/POC/EPSS all negative or missing). Given Chrome's enormous install base, patch promptly on the normal browser-update cadence, but this does not warrant emergency out-of-band action on current evidence.

An attacker crafts a malicious HTML page that abuses the incorrect-authorization flaw in Chrome's Search component on Android and lures a victim - via phishing, a malicious ad, or a shared link - into opening it in a vulnerable Chrome version. If the victim interacts as intended, the flaw could allow code execution outside the browser sandbox on the Android device. No public exploit code was identified at time of analysis.