Google Chrome CVE-2026-106244

Exploitation targets Chrome's Permissions subsystem and requires the victim to run a vulnerable Chrome build prior to 155.0.8059.39 and to process attacker-supplied 'crafted network traffic' (i.e., attacker-controlled web content or responses reaching the browser). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required once the crafted traffic is delivered, and default configurations are affected. The practical limiting factors are: the attacker must get the targeted browser to fetch or process the malicious content, impact is constrained to limited confidentiality/integrity (no code execution or availability impact indicated), and updated Chrome versions (155.0.8059.39 or later) fully remediate the flaw.

This is a medium-severity, lower-priority issue despite its network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) indicates a remotely reachable, low-complexity flaw requiring no privileges and no user interaction, but impact is limited to Low confidentiality and Low integrity with no availability effect - consistent with an authorization-bypass (CWE-863) that exposes or alters restricted data rather than granting full compromise. The exploitation signals argue against urgency: EPSS is 0.17% (5th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data, so there is no public exploit identified at time of analysis. Google/Chromium rated the security severity Medium, which aligns with the limited technical impact. The main risk amplifier is prevalence, not severity - Chrome's enormous install base means even a medium flaw is worth patching promptly, but the low EPSS and absence of active-exploitation evidence place this below critical browser RCEs. No SSVC decision data was provided in the input; note also that the input Tags label this 'Authentication Bypass' while the description and CWE-863 describe an incorrect-authorization (access-restriction) bypass, which is a distinct category - treat the 'bypass' as an authorization, not authentication, issue.

A remote attacker sends crafted network traffic to a targeted Chrome user (for example by getting them to load attacker-controlled content), triggering the incorrect authorization check in Chrome's Permissions handling. This lets the attacker bypass system access restrictions to reach resources or permissions that should have been denied, exposing limited data or allowing limited unauthorized modification. No public proof-of-concept was identified at time of analysis, and the attack needs no authentication or user interaction per the CVSS vector.