Google Chrome CVE-2026-106272

Requires the victim to be running Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows at a version prior to 155.0.8059.39, and requires the victim to interact with the session (UI:R) under attacker social-engineering pressure. The attacker must be positioned to deliver crafted network traffic to the Chromoting connection. Limiting factors: mandatory user interaction plus social engineering (not automatable), dependence on the Chromoting feature being actively in use rather than a default always-on surface, Windows-only scope, and no elevation of impact beyond UI spoofing (no code execution or authenticated access granted).

This is a genuinely low-priority issue despite its network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) yields a base score of 5.4 (medium), but two factors heavily constrain real-world risk: UI:R means the attack cannot succeed without victim interaction, and the description explicitly requires social engineering, so exploitation is not automatable. Google's own Chromium severity rating is 'Low,' which aligns with the limited technical impact (UI spoofing, not code execution or data theft). No EPSS score, CISA KEV listing, or public exploit code was provided in the intelligence, so there is no evidence of exploitation probability or active use. Exploitation status: no public exploit identified at time of analysis. One internal inconsistency to verify: the official vector lists A:L (low availability impact), which is unusual for a pure UI-misrepresentation flaw (CWE-451) where the expected impact is integrity/confidentiality of displayed information - verify the availability impact with the vendor advisory. Overall, this ranks well below Chrome's actively-exploited RCE and sandbox-escape bugs and should be remediated via normal patch cadence.

An attacker uses social engineering to induce a victim running Chrome Remote Desktop (Chromoting) on Windows to interact with an attacker-influenced session, then sends crafted network traffic that causes Chrome to render spoofed or misleading UI elements. The victim, trusting the falsified interface, is deceived into taking an action (e.g., approving a connection or trusting displayed information). No public exploit code was provided, and success depends entirely on the victim's interaction.