Google Chrome CVE-2026-106282

Exploitation requires the victim to navigate to an attacker-controlled crafted HTML page running in Google Chrome prior to 155.0.8059.39 and to interact with the spoofed WebOTP interface (CVSS UI:R). No authentication or prior privileges are needed (PR:N), and default configurations are affected since WebOTP is a standard browser API. The key limiting factors are the mandatory user interaction and social-engineering dependency - the attack only succeeds if the user is actually deceived by the spoofed UI - and the fact that an up-to-date Chrome (>=155.0.8059.39) is not vulnerable, so Chrome's automatic update mechanism rapidly shrinks the exposed population.

This is a genuinely low-to-moderate priority issue despite its network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, base 5.4) describes a remote, unauthenticated, low-complexity attack, but it is gated by UI:R - the victim must actively visit and interact with an attacker-controlled page - and Chromium itself rated this only Medium severity, consistent with a UI-spoofing (CWE-451) class flaw rather than memory corruption or code execution. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the finding was reported internally by Google's own Chrome team rather than discovered via in-the-wild attacks. The C:L and A:L impact ratings are somewhat generous for what is fundamentally a UI misrepresentation/spoofing bug - the realistic harm is user deception (e.g., tricking a user about a WebOTP prompt) rather than direct data theft or crash, so I:N is appropriate but the C:L/A:L values should be read as deception-enabled rather than direct technical impact. Net: a real but low-urgency bug best handled through normal Chrome auto-update cycles, not emergency patching.

An attacker hosts a crafted HTML page and lures a Chrome user to it via phishing link or malicious ad. The page manipulates the WebOTP interface to spoof trusted UI elements, deceiving the victim into believing a one-time-passcode prompt or origin indicator is legitimate, potentially leading them to disclose an OTP or trust a fraudulent request. No public exploit code is identified at time of analysis, and the attack requires the user to visit the page (UI:R).