Google Chrome CVE-2026-106317

Exploitation requires the victim to use Google Chrome on Android (versions prior to 155.0.8059.39) and to actively navigate to an attacker-controlled crafted HTML page, which must invoke the FullScreen feature to misrepresent the address bar - so the fullscreen rendering path is the specific feature prerequisite. It affects default configurations (no special settings needed) but is fundamentally limited by the required user interaction (visiting the malicious page) and by the fact that success depends on social-engineering the user into trusting the spoofed URL; it grants no code execution, no bypass of authentication, and no direct data access on its own.

This is a genuinely low-priority issue, and multiple independent signals agree, which is itself a confidence-raising cross-reference. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, base 5.4) describes a network-reachable, unauthenticated flaw, but it requires user interaction (UI:R) and yields only low-confidentiality impact with unchanged scope - consistent with an address-bar spoof rather than code execution or data theft. Google/Chromium rated the underlying bug severity 'Low'. The SSVC decision framework reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no (each victim must be individually lured), and Technical Impact=partial. No KEV listing and no POC were provided, so exploitation status is 'no public exploit identified at time of analysis'. No EPSS score was supplied; its absence is not itself an error but does mean probabilistic exploitation likelihood cannot be quoted. One internal inconsistency worth noting: the published vector includes A:L (low availability impact), which is unusual for a pure UI-misrepresentation/spoofing weakness (CWE-451) where no availability degradation is described - verify with vendor, as the realistic impact is deception enabling phishing, not denial of service. Net assessment: a high-reach product but a low-severity, interaction-dependent spoofing bug - patch in routine cycles, not an emergency.

A remote attacker hosts a crafted HTML page that abuses Chrome for Android's fullscreen handling to redraw or suppress the address bar, displaying a legitimate-looking URL while the user is actually on the attacker's page. A victim lured to this page (UI:R) is deceived into trusting the spoofed origin and may enter credentials or sensitive data into a phishing form. No public exploit code was identified at the time of analysis.