Google Chrome CVE-2026-106260

Exploitation requires the DevTools incorrect-authorization code path in Google Chrome versions prior to 155.0.8059.39 and depends on social engineering: the victim must be lured to an attacker-crafted HTML page and must perform interaction (CVSS UI:R), which is the primary limiting factor. No authentication is required (PR:N), and the attack is network-delivered against the browser, but impact is confined to leaking cross-origin data (C:L; no integrity or availability impact). The need for active user interaction and a convincing lure, combined with only limited confidentiality disclosure, substantially constrains realistic exploitation despite Chrome's huge footprint.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable but user-interaction-dependent flaw with only limited confidentiality impact and no integrity or availability impact - matching Chromium's own 'Low' severity rating and the CWE-863 (Incorrect Authorization) classification. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The one factor that amplifies attention is prevalence: Chrome is ubiquitous, so even a low-severity DevTools authorization flaw has an enormous installed base. However, the requirement for social engineering plus active victim interaction and the leak being limited to cross-origin data (no code execution, no persistence) keeps real-world risk low. Net: high deployment footprint but low exploitability and low impact - this is a routine patch-cycle item, not an emergency. Note the input 'Authentication Bypass' tag conflicts with the actual weakness, which is incorrect authorization (authentication is not bypassed); treat the tag with caution.

An attacker crafts a malicious HTML page and uses social engineering (e.g., a phishing link or lure) to convince a Chrome user to open it and interact with it while conditions trigger the DevTools authorization flaw. The crafted page abuses incorrect authorization in DevTools to read data belonging to a different origin, leaking limited cross-origin information to the attacker. No public exploit code is identified, and successful attack depends on the victim performing the required interaction.