Google Chrome CVE-2026-106280

Exploitation requires the victim to actively load attacker-controlled HTML in a vulnerable Chrome desktop build prior to 155.0.8059.39 (UI:R - this user-interaction requirement is the primary limiting factor, preventing silent or server-side triggering). No authentication or prior privileges are needed (PR:N), and default Chrome configurations are affected since the flaw is in the core PermissionElement authorization handling rather than an optional feature. The bypass is scoped to Chrome's web-origin/same-origin enforcement; it does not by itself yield code execution. Exploitation is further limited by Chrome's rapid automatic update mechanism, which rolls the fix out broadly soon after release.

This is a medium-severity Chrome flaw (CVSS 6.5) whose signals are consistent and point to a low-to-moderate real-world priority rather than an urgent threat. The CVSS vector (AV:N/AC:L/PR:N/UI:R) describes a remote, unauthenticated, low-complexity attack that nonetheless requires user interaction - the victim must visit a crafted HTML page - which caps automated mass-exploitation. All corroborating signals agree: EPSS is very low (0.19%, 8th percentile), the vulnerability is NOT listed in CISA KEV, and the CISA SSVC decision framework reports Exploitation: none, Automatable: no, and Technical Impact: partial. No public exploit code was identified in the provided sources. The impact is scoped to integrity only (C:N/I:H/A:N in the supplied vector) via a web-origin/same-origin policy bypass, not full code execution. There are no conflicting signals here - every source (NVD CVSS, EPSS, SSVC, Chromium's own Medium rating) is internally consistent. Verdict: a legitimate fix to apply via routine Chrome auto-update, but not a drop-everything priority; treat as standard patch-cycle hygiene unless active exploitation emerges.

An attacker hosts or compromises a web page containing crafted HTML that abuses the PermissionElement's incorrect authorization logic. When a victim running a vulnerable Chrome build (prior to 155.0.8059.39) visits the page, the attacker's content bypasses the browser's web-origin policy to perform actions or access context that should be restricted to another origin. No public proof-of-concept exploit was identified in the provided data, and successful exploitation depends on the victim actively loading the malicious page.