Google Chrome CVE-2026-106286

Exploitation requires the victim to run a vulnerable Chrome build (before 155.0.8059.39) and to interact with attacker-influenced content - the CVSS UI:R metric confirms user interaction (e.g., visiting a crafted page) is mandatory, which is the primary limiting factor. The attacker must be able to deliver crafted network traffic to the Omnibox/browser, but no authentication or prior privileges are needed (PR:N). No special non-default Chrome configuration is indicated; impact is limited to integrity (origin-policy bypass) with no stated confidentiality or availability effect, and no scope change (S:U).

Signals are consistent and point to a genuine but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, base 6.5) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (UI:R) and yields only integrity impact (C:N/I:H/A:N) with no scope change - Chromium's own rating of Medium aligns with this. The exploitation signals reinforce low urgency: EPSS is 0.17% (6th percentile), there is no CISA KEV listing, no public POC was identified, and CISA SSVC scores Exploitation=none, Automatable=no, Technical Impact=partial. There is no conflict among these sources: a low-probability, non-automatable, partial-impact, user-interaction-gated origin bypass is a real browser security fix but not an emergency. One minor inconsistency worth noting: the vendor assigns C:N despite this being a web-origin-policy (confused deputy, CWE-441) bypass, where some confidentiality exposure is often plausible - the integrity-only scoring suggests the concrete impact is origin/content spoofing or injection rather than cross-origin data theft; verify against the Chromium issue if confidentiality matters to your threat model.

A remote attacker lures a Chrome user (prior to 155.0.8059.39) to a malicious or attacker-influenced page and serves crafted network traffic that causes the Omnibox to act as a confused deputy, letting content be treated under the wrong web origin. No public exploit code was identified, and successful exploitation depends on the victim interacting with attacker-controlled content (UI:R).