Google Chrome CVE-2026-106250

Exploitation requires an attacker to deliver a crafted HTML page AND to socially engineer a Chrome user into visiting/interacting with it (UI:R) - the flaw is a missing authorization check (CWE-862) in Chrome's Actor component that bypasses intended system access restrictions. It affects Google Chrome desktop versions prior to 155.0.8059.39; patched builds are not vulnerable. Limiting factors that reduce real-world risk: mandatory user interaction (no drive-by against a passive user is implied beyond visiting the page), impact capped at Low confidentiality and Low integrity with no availability or privilege escalation, and no scope change. No special non-default configuration is stated as required, but the social-engineering dependency is the primary constraint defenders should weigh.

This is a genuinely low-priority issue despite its MEDIUM 5.4 CVSS rating, and the multiple signals are consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) describes a network-reachable, unauthenticated flaw, but exploitation hinges on user interaction (UI:R) driven by social engineering and yields only Low confidentiality and Low integrity impact with no availability loss and no scope change. Google itself rated the Chromium security severity as Low, which aligns with the limited impact metrics. The EPSS score of 0.18% (7th percentile) indicates a very low probability of observed exploitation, there is no CISA KEV listing (not actively exploited) and no public exploit identified, so all exploitation signals point the same direction. The only factor elevating concern is prevalence - Chrome is ubiquitous - but the required user interaction, the low technical impact, and the absence of exploitation evidence make this a routine patch-on-cycle item rather than an emergency. No SSVC decision data was supplied in the input, so exploitation/automatability/technical-impact cannot be cross-referenced from that framework.

A remote attacker crafts a malicious HTML page and uses social engineering (e.g., a phishing link or deceptive site) to lure a Chrome user into visiting it, where a missing authorization check in the Actor component lets the page bypass intended system access restrictions. Because user interaction is required and impact is limited to low-severity confidentiality and integrity effects, the attacker gains only partial, non-persistent access rather than full compromise. No public proof-of-concept or active exploitation has been identified for this flaw.