Google Chrome CVE-2026-106303

Exploitation requires the attacker to have ALREADY compromised the Chrome renderer process (e.g., via a separate sandbox-contained RCE) before this flaw is useful - this is the primary limiting factor and makes it a chained post-exploitation primitive rather than an initial-access vector. It additionally requires victim interaction obtained through social engineering (UI:R) and delivery of an attacker-crafted HTML page that engages the Autofill AI feature; the information leak stems from an observable timing/behavioral discrepancy in Autofill AI. It affects Chrome builds prior to 155.0.8059.39; patched builds are not exploitable. The compounded requirements (prior renderer compromise + user interaction + specific feature engagement) reflect the AC:H and UI:R metrics and substantially limit realistic, scalable exploitation.

This is a genuine-but-low-priority issue once context is applied. The CVSS base score of 5.3 (Medium) is driven by C:H, but the signals converge on limited real-world urgency: SSVC from CISA states Exploitation: none, Automatable: no, Technical Impact: partial, and there is no KEV listing and no public POC identified. EPSS was not provided in the input. The most important caveat is a precondition mismatch: the CVSS vector encodes PR:N (no privileges), yet the description explicitly requires 'a remote attacker who had compromised the renderer process' AND social engineering of the victim - two substantial prerequisites that the AC:H and UI:R metrics only partially capture. In practice an attacker must already have a working renderer exploit before this flaw yields value, so it is best understood as a post-exploitation information-disclosure primitive chained after a sandbox-contained compromise, not a standalone remotely triggerable bug. Treat it as a defense-in-depth fix bundled into the Chrome stable update rather than an emergency; prioritize via normal browser patch cadence.

An attacker who has already achieved code execution inside a sandboxed Chrome renderer process serves the victim a crafted HTML page and uses social engineering to induce interaction that triggers the Autofill AI feature. The observable discrepancy (CWE-203) then leaks sensitive autofill-derived information back to the attacker-controlled renderer context. No public exploit code or active exploitation is identified at time of analysis.