Google Chrome CVE-2026-106251

Exploitation requires an active Google Chrome Remote Desktop (Chromoting) session on macOS running a version prior to 155.0.8059.39, plus an attacker positioned to inject or manipulate the session's network traffic. Critically, the attack cannot succeed on its own: the CVSS vector requires user interaction (UI:R) and the description specifies a social-engineering component, meaning the victim must be deceived into trusting and acting on the spoofed UI elements. These factors - mandatory victim interaction, the niche Chromoting feature being in use, and macOS-only applicability - materially limit real-world exploitability despite the network attack vector.

This is a genuinely low-priority issue that should not be escalated above routine patching. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) indicates a network-reachable, low-complexity, unauthenticated flaw, but exploitation hinges on UI:R - the victim must actively engage with a social-engineering lure - and impact is limited (C:L, I:N, A:L) with no scope change. Google/Chromium independently rated the security severity 'Low,' which aligns with the modest impact of a UI-spoofing (CWE-451) weakness rather than code execution or data theft. No EPSS score was provided in the input, so exploitation probability cannot be quantified; it is NOT in CISA KEV and no proof-of-concept is referenced, so this is 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input. Net signal: a real but low-consequence deception bug whose network attack vector is substantially offset by the mandatory user-interaction and social-engineering requirement - a maintenance-cadence fix, not an emergency.

An attacker able to influence network traffic to a Chrome Remote Desktop (Chromoting) session on macOS crafts packets that cause spoofed or misleading UI elements to render in the victim's client. Combined with a social-engineering pretext, the victim is tricked into trusting the forged interface and taking an action (e.g., approving a connection or disclosing information) they otherwise would not. No public exploit code is identified at time of analysis, and successful exploitation requires the victim to interact with the manipulated UI.