Google Chrome CVE-2026-106297

Exploitation requires the victim to actively load an attacker-controlled crafted HTML page in a vulnerable Chrome build prior to 155.0.8059.39 (UI:R in the CVSS vector); it cannot be triggered without this user interaction. The flaw lies in the browser's Scheduling component's authorization handling, which fails to correctly enforce the web origin policy. No special target-side configuration, authentication, or privileges are needed (PR:N), and default Chrome installations are affected, but the mandatory user navigation to the malicious page and the limited (integrity-only, I:L) impact substantially constrain real-world exploitation.

This is a low-priority issue despite the moderate 4.3 CVSS score. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) shows a network-reachable, low-complexity, unauthenticated flaw, but one that requires user interaction (UI:R) and yields only limited integrity impact (I:L) with no confidentiality or availability impact - consistent with Google's own 'Low' Chromium severity rating. Supporting signals reinforce the low real-world urgency: EPSS is only 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data. The signals are internally consistent rather than conflicting - moderate-vector score but low impact, low exploitation probability, and no evidence of exploitation all point the same direction. The main caveat is breadth of exposure: Chrome is ubiquitous, so even a low-severity origin-policy bypass affects an enormous installed base, which is why it still warrants routine patching. No key data is contradictory; the primary limitation is that the public description is deliberately sparse (Chromium restricts bug details), so the precise mechanism of the web origin policy bypass is not independently verifiable.

An attacker hosts a crafted HTML page and lures a victim running a vulnerable Chrome build (prior to 155.0.8059.39) to visit it. Due to incorrect authorization in the Scheduling component, the page bypasses web origin policy enforcement to improperly read or influence data it should not have access to across origins. No public exploit code was identified at time of analysis, and the attack cannot proceed without the victim actively loading the attacker-controlled page.