Google Chrome CVE-2026-106302

Exploitation requires the victim to visit an attacker-crafted HTML page and to be deceived by the spoofed UI - i.e., active user interaction plus successful social engineering (UI:R in the vector). The specific affected feature is Chrome's PermissionElement, so the flaw manifests in the browser's permission-prompt UI rendering. Limiting factors: no attacker-controlled technical compromise occurs without human deception, exploitation cannot be automated (SSVC Automatable:no), and the affected product is any Google Chrome build prior to 155.0.8059.39; patched versions are not affected.

This is a genuine-but-low-priority issue. All exploitation signals point the same direction: CVSS is only 5.4 (Medium), the Chromium team rated severity Medium, and CISA SSVC scores it Exploitation:none, Automatable:no, Technical Impact:partial - a consistent picture with no conflict. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) confirms network-reachable, low-complexity, unauthenticated exploitation but critically requires user interaction (UI:R), which aligns with the description's dependence on social engineering. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit identified, so this is not actively exploited. The core limiter is that this is a UI-spoofing/misrepresentation flaw (CWE-451) whose harm depends entirely on successfully tricking a human, not on automatable technical compromise - so despite the network attack vector it is realistically a low operational risk that should be remediated via the routine Chrome auto-update cycle rather than as an emergency.

A remote attacker crafts a malicious HTML page that abuses the PermissionElement to visually misrepresent or spoof browser UI (e.g., a permission prompt), then lures a victim via phishing or a malicious link to visit it. The spoofed UI could mislead the user into granting a permission or trusting content they otherwise would not. No public exploit code was identified at time of analysis, and success depends on the victim interacting with the crafted page.