Google Chrome CVE-2026-106325

Exploitation requires the victim to actively visit an attacker-controlled or compromised web page containing crafted HTML (UI:R), reached via social engineering such as phishing or a malicious link - there is no fully silent drive-by path described. No authentication is required (PR:N) and the attack works against standard Chrome installations prior to 155.0.8059.39 with no special configuration noted. The key limiting factors are the mandatory user interaction and the low technical impact: only a cross-origin data leak (confidentiality), with no code execution, integrity, or availability effect.

This is a genuinely low-priority issue despite being network-reachable. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) shows remote, unauthenticated reach with low attack complexity, but exploitation hinges on user interaction (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability impact. All corroborating signals point the same direction: Google/Chromium rated the security severity 'Low', CISA's SSVC framework records Exploitation: none, Automatable: no, and Technical Impact: partial. No EPSS score was supplied, the CVE is not in CISA KEV, and no public exploit code was referenced - there is no public exploit identified at time of analysis. The signals are consistent rather than conflicting: a low-severity, interaction-dependent cross-origin information leak that is not automatable. Note that EPSS data is missing from the input, so the quantitative exploitation-probability dimension could not be factored in; however, given the UI requirement and 'none' exploitation status, widespread opportunistic exploitation is unlikely.

An attacker crafts a malicious HTML page that abuses incorrect reference resolution in Chrome's Core and uses social engineering (e.g., a phishing link or malicious ad) to lure a victim into visiting it. When the page loads, it leaks limited data belonging to another origin that the victim's browser has access to. No public proof-of-concept or exploit code is referenced in the available data.