Google Chrome CVE-2026-106312

Exploitation requires the victim to be socially engineered into installing a crafted, attacker-controlled Chrome extension; the flaw is the missing authorization check in Chrome's SignIn component that the installed extension then abuses to read sensitive information. Limiting factors: this is not a drive-by - it depends on active user interaction (UI:R) to install an untrusted extension, meaning users who only install extensions from trusted sources are not realistically exposed. No special server-side or non-default browser configuration is required beyond the presence of the malicious extension, and impact is limited to information disclosure (no integrity or availability effect). Affects Chrome versions prior to 155.0.8059.39.

This is a moderate-but-not-urgent issue despite the 6.5 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates a network-reachable, unauthenticated, low-complexity confidentiality-only flaw, but the headline risk is heavily tempered by two factors the vector only partially captures: Google/Chromium rated the security severity 'Low', and the description makes clear that exploitation requires BOTH user interaction (UI:R) AND social engineering to get a victim to install a crafted Chrome extension. That precondition conflicts with the C:H impact rating - a missing-authorization info-leak gated behind attacker-controlled extension installation is realistically closer to low/medium impact, which is why I down-rate confidentiality in my independent assessment. On the exploitation-signal side there is no CISA KEV listing, no public POC identified, and no EPSS score was provided in the input, so there is no evidence of active or at-scale exploitation. SSVC-style reading: exploitation=none observed, automatable=no (requires per-victim social engineering and manual extension install), technical impact=partial (information disclosure only, no integrity/availability). Net: a real but low-priority bug that is already patched; prioritize via normal Chrome auto-update rather than emergency response. Note the missing EPSS data limits precision on exploitation likelihood.

An attacker publishes or distributes a specially crafted Chrome extension and uses social engineering (phishing, fake tooling, or a deceptive listing) to convince a victim to install it. Once installed, the extension abuses the missing authorization check in Chrome's SignIn component to read sensitive information it should not have access to. No public exploit code has been identified, and successful attack depends entirely on the victim installing the malicious extension.