Google Chrome CVE-2026-106308

Exploitation requires the victim to be running Google Chrome on Android at a version prior to 155.0.8059.39 and to actively open an attacker-crafted HTML page delivered via social engineering (UI:R in the CVSS vector). The vulnerable surface is the Autofill feature, so a victim with usable autofill data present is implied; no authentication is required (PR:N), but the mandatory user interaction and reliance on social engineering are the key limiting factors that reduce realistic exploitability. It is desktop-independent - only the Android build is listed as affected.

Signals conflict and should be reconciled before prioritization. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) rates this as a remote, low-complexity, unauthenticated bug requiring user interaction - but the description characterizes the flaw purely as an information-disclosure issue ('obtain sensitive information'), which does not justify the I:H/A:H integrity and availability impacts in the input vector. This looks like Chrome's standard high-severity renderer scoring applied to what is functionally a confidentiality-only defect, so the 8.8 likely overstates real impact (see assessed vector below, ~6.5). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. A patch is available from the vendor. Net: this is a genuine, patch-worthy browser bug in a ubiquitously deployed product, but absent exploitation signals and given that it is confidentiality-only and gated behind user interaction plus social engineering, it is a routine 'patch in the normal cycle' item rather than an emergency - not a high-real-risk priority despite the high CVSS.

A remote attacker crafts a malicious HTML page and uses social engineering (e.g., a phishing link or lure) to convince an Android Chrome user to open it. Incorrect reference resolution in the Autofill component then causes the page to obtain sensitive autofill data from the victim. No public exploit code has been identified, and exploitation requires the victim to actively visit the attacker-controlled page.