Google Chrome CVE-2026-106316

Exploitation requires the victim to be using the Chromoting (Chrome Remote Desktop) component of Google Chrome on macOS at a version prior to 155.0.8059.39, and the attacker must be positioned to deliver crafted network traffic to that session. Per CVSS UI:R, the attack cannot succeed autonomously - it depends on the user interacting with and being deceived by the spoofed UI element (social engineering, as stated in the description). These limiting factors (Mac-only, Chromoting feature in use, attacker network position, and required user deception) substantially narrow realistic exploitation beyond what the AV:N vector alone suggests. No authentication is required (PR:N).

This is a genuinely low-priority issue, and the available signals agree rather than conflict. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, base 5.4) describes a network-reachable, unauthenticated flaw, but it explicitly requires user interaction (UI:R) and Google itself rated the Chromium security severity as Low. There is no CISA KEV listing, no public exploit code identified, and no EPSS score was supplied in the input - so there is no evidence of active or probable near-term exploitation. The CWE-451 (UI misrepresentation / spoofing) nature of the bug means the realistic worst case is tricking a user via a spoofed UI element during a Chrome Remote Desktop (Chromoting) session, not code execution or data theft at scale. Note a data gap: EPSS is absent from the input, so the probabilistic exploitation signal cannot be weighed; however, the combination of Low vendor severity, required user interaction, mandatory social engineering, and the narrow Mac-plus-Chromoting precondition all point to low real-world risk despite the 'network' attack vector.

An attacker who can influence network traffic to a victim's Chrome Remote Desktop (Chromoting) session on macOS crafts packets that cause Chrome to render misleading or spoofed UI elements. Combined with social engineering, the victim is deceived into trusting a fake interface element and taking an unsafe action. No public exploit code was identified at time of analysis, and success depends on the user interacting with the spoofed UI.