Google Chrome CVE-2026-106265

Exploitation requires the attacker to get a victim to visit an attacker-controlled, specially crafted HTML page (UI:R) and then be successfully deceived by the spoofed browser UI - i.e., this is a social-engineering-dependent flaw, not a silent drive-by compromise. There is no authentication requirement (PR:N) and the attack is remote over the network (AV:N), but the mandatory user interaction and reliance on the victim acting on the falsified interface are the key limiting factors. It affects Chrome builds prior to 155.0.8059.39; updating to 155.0.8059.39 or later removes the condition. No special non-default Chrome configuration is indicated in the description.

This is a genuinely medium-risk, not an overhyped high-severity issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, base 5.4) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (UI:R) and yields only limited impact - consistent with a UI-spoofing (CWE-451) weakness rather than code execution or data theft. Google/Chromium themselves rated it Medium severity, which aligns with the CVSS score. No EPSS score, SSVC decision, or KEV/POC indicator was provided: it is NOT in CISA KEV and no public exploit was supplied, so exploitation status is 'no public exploit identified at time of analysis.' One internal inconsistency is worth flagging: the vector lists Availability impact as A:L, which is unusual for a pure UI-misrepresentation/spoofing bug (these typically affect confidentiality/integrity of what the user perceives, not availability) - verify the A:L rating with the vendor. The real driver of priority here is Chrome's enormous install base combined with the fact that a patch already exists; the realistic risk is phishing/social-engineering amplification rather than direct system compromise, so this is a routine 'patch in normal cycle' item, not an emergency.

A remote attacker crafts a malicious HTML page that manipulates Chrome UI elements (e.g., address-bar, dialog, or security-indicator rendering) so they misrepresent the true origin or security state. The victim is lured to the page via phishing or a malicious link, and the spoofed UI convinces them to trust the content or enter sensitive information. No public exploit code was provided in the intelligence set, and successful exploitation depends on the user being deceived (UI:R).