Google Chrome CVE-2026-106263

Exploitation requires the victim to be socially engineered into actively installing a crafted Chrome extension - the flaw is in Chrome's SignIn component and manifests when the malicious extension is added. This user-interaction step (UI:R) is the primary limiting factor: there is no drive-by or server-side trigger, and the attacker cannot proceed without the victim's install action. It affects Chrome versions prior to 155.0.8059.39; patched builds are not exploitable. No authentication to the target system is required (PR:N), but the social-engineering dependency substantially narrows realistic exploitation.

Signals align consistently toward a moderate, non-urgent risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, base 6.5) describes a network-reachable, low-complexity, unauthenticated flaw whose exploitation hinges on required user interaction (UI:R) - the description confirms this interaction is social engineering to get a victim to add a crafted Chrome extension. Impact is integrity-only (I:H; C:N/A:N), matching a 'bypass system access restrictions' outcome rather than data theft or crash. The EPSS score is very low at 0.17% (6th percentile), and SSVC reports Exploitation=none, Automatable=no, Technical Impact=partial - all three reinforce that this is neither actively exploited nor readily weaponized at scale. There is no CISA KEV listing and no public POC identified. No key signals conflict; the UI:R requirement and SSVC Automatable=no are the dominant limiting factors that keep this a Medium-severity, lower-priority item despite Chrome's enormous install base. This is a patch-in-normal-cycle issue, not an emergency, though the ubiquity of Chrome means it should not be indefinitely deferred.

An attacker uses social engineering (e.g., a deceptive website or message) to convince a victim to install a specially crafted Chrome extension. Because of improper input validation in Chrome's SignIn component, the malicious extension bypasses system access restrictions that would normally contain it, compromising integrity of the browser's protected state. No public exploit code has been identified, and success depends entirely on the victim taking the install action.