Google Chrome CVE-2026-106246

Exploitation requires the attacker to control a web page and have the victim navigate to it (UI:R) - there is no authentication requirement (PR:N) and no special Chrome configuration is named in the description, so default installs of Chrome prior to 155.0.8059.39 are affected. The key limiting factors are: (1) the victim must actively visit the attacker's crafted HTML page, and (2) the impact is limited to spoofing the address bar - it does not by itself grant code execution or data access, so damage depends on the user being deceived into a subsequent action (e.g., entering credentials). Patched by updating to Chrome 155.0.8059.39 or later.

This is a medium-severity (CVSS 5.4) address-bar spoofing issue in Google Chrome stemming from incorrect authorization (CWE-863). The provided CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) indicates a network-reachable, low-complexity, unauthenticated attack that nonetheless requires user interaction - the victim must open an attacker-controlled HTML page. No EPSS score was supplied, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced, so there is no evidence of active or imminent widespread exploitation. The real-world priority is moderate rather than urgent: the signals are internally consistent (a spoofing/UI-deception flaw that aids phishing but yields no direct code execution or data theft), but the absence of EPSS data means statistical exploitation likelihood cannot be quantified. Note a scoring inconsistency to verify with the vendor: Google's input vector assigns C:L and A:L, yet an address-bar spoof's primary effect is misrepresentation of displayed content (an integrity concern), with no obvious confidentiality or availability impact - treat the exact impact metrics as vendor-assigned rather than independently confirmed. Given Chrome's enormous install base, even a medium spoofing bug is worth patching promptly as a phishing enabler, but it is not a high-priority RCE-class emergency.

An attacker hosts a crafted HTML page and lures a victim to visit it (e.g., via a phishing link or malicious ad). The page manipulates Chrome's address bar so the displayed URL appears to belong to a trusted site, increasing the credibility of a follow-on phishing or credential-harvesting page. No public exploit code is identified at time of analysis, and successful deception depends on the user visiting the page and trusting the spoofed bar.