Google Chrome CVE-2026-106254

Exploitation requires a separate attacker-controlled app to already be co-installed on the same Android device as Chrome (versions prior to 155.0.8059.39); it cannot be triggered remotely over the network. The CVSS AC:H rating indicates additional non-deterministic conditions (such as timing or specific device/app state) must be met, further limiting reliability. No user interaction or authentication is required once the malicious app is present, but the need to first place a hostile app on the device is the primary limiting factor. Desktop and non-Android Chrome builds are not in scope per the description.

This is a moderate-severity, low-real-world-priority issue. The provided CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.1) is internally consistent with the description: the attack vector is explicitly local (AV:L) because exploitation requires a co-installed malicious app already present on the same Android device, and attack complexity is High (AC:H), implying the attacker must win a race or satisfy conditions outside their control. Although privileges are None (PR:N) and no user interaction is needed, the local-only vector and high complexity sharply constrain real-world exploitability - an attacker must first get a hostile app onto the victim's device. No EPSS score was supplied, the CVE is not in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The confidentiality-only impact (C:H, I:N, A:N) means successful exploitation leaks sensitive information but does not grant code execution or integrity/availability loss. Net: a legitimate but low-urgency patch-cycle item rather than an emergency, driven by the local vector, high complexity, and absence of any exploitation signal.

A user installs a malicious or compromised app from the Play Store or a sideloaded source onto an Android device that also runs Chrome. The hostile app leverages the co-installed-app information leak to read sensitive data belonging to Chrome without any user interaction or elevated privileges, though it must satisfy the high-complexity timing/condition requirements. No public exploit is currently known.