Google Chrome CVE-2026-106288

Exploitation requires the victim to be running Google Chrome prior to 155.0.8059.39 and to be lured into visiting an attacker-crafted HTML page (UI:R), as the flaw is explicitly described as leveraging social engineering. No authentication or elevated privileges are needed (PR:N), and no special Chrome configuration or non-default feature is cited in the description. The primary limiting factors are the mandatory user interaction (the user must open the malicious page) and the Low technical impact (C:L/I:L/A:N), meaning a successful bypass yields only partial access to the restricted system functionality rather than full compromise. No active exploitation has been observed (SSVC Exploitation: none).

This is a genuinely low-priority issue despite the medium CVSS base score of 5.4, and the multiple intelligence signals are mutually consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) describes network reach with low complexity and no privileges, but the required user interaction (UI:R) and the self-described 'social engineering' element materially cap real-world impact, and both confidentiality and integrity impact are only Low with no availability impact. Google/Chromium itself rated the security severity as Low. The EPSS score of 0.19% (8th percentile) indicates very low predicted exploitation likelihood, which aligns with the SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) and the absence of any CISA KEV listing or public exploit code. All corroborating signals - vendor severity, EPSS, SSVC, and KEV status - point the same direction: a real but minor missing-authorization/access-restriction bypass that depends on tricking a user, not a widespread automatable threat. No signal is in tension here; the only caveat is the thin public technical detail (the Chromium issue tracker entry is typically access-restricted at disclosure time).

An attacker hosts a crafted HTML page and uses social engineering (phishing link, malicious ad, or lure) to get a Chrome user to visit it; the page abuses a missing authorization check to bypass a system access restriction enforced by the browser. No public exploit code has been identified, and success depends on the victim actually opening the attacker-controlled page, so impact is limited to partial information or integrity effects on that user's session.