Google Chrome CVE-2026-106313

Exploitation requires a LOCAL attacker on the same Android device: specifically, a malicious application must be co-installed alongside Google Chrome (versions prior to 155.0.8059.39), and the attacker must successfully use social engineering to get the victim to install or run that app. The flaw lies in an incorrect authorization check in Chrome's Browser component that lets the co-installed app obtain sensitive information it should not be able to access. Limiting factors that reduce real-world risk: no remote/network reachability (AV:L), High attack complexity (AC:H) reflecting the dependence on a non-trivial co-installation and social-engineering precondition, confidentiality-only impact (no integrity or availability loss), and applicability only to Chrome on Android below the fixed build.

This is a genuinely low-to-moderate priority issue despite the CWE-863 (incorrect authorization) classification. The provided CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.1, Medium) is internally consistent with the description: a LOCAL attack vector (not remote/network), HIGH attack complexity, and impact limited to confidentiality (C:H, no integrity or availability impact). All exploitation-probability signals point the same direction and reinforce low urgency: SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial, meaning CISA's framework sees no observed exploitation and no reliable automation path. There is no CISA KEV listing and no EPSS score supplied; no public exploit code is referenced. The strongest mitigating factor is the attack prerequisite chain - a LOCAL attacker must already have a malicious app co-installed on the victim's Android device AND must successfully apply social engineering - which is why AC is High and why this did not warrant a High/Critical rating. Note one tension worth flagging: the description says 'local attacker leveraging social engineering,' which strongly implies some user interaction, yet the input vector sets UI:N; this is a minor modeling choice and does not change the overall low-urgency conclusion. Bottom line: a real but narrow information-disclosure bug, appropriately rated Medium, not a mass-exploitation threat - patch via normal Chrome update cycles rather than emergency response.

An attacker convinces a victim (via social engineering) to install a malicious app alongside Chrome on their Android device. The co-installed app then abuses Chrome's incorrect authorization check to read sensitive information it should not be permitted to access. No public exploit code is identified, and the local vector plus high complexity mean this is an opportunistic, device-local attack rather than a remote mass-exploitation scenario.