Google Chrome CVE-2026-106328

Exploitation requires a malicious application already co-installed on the same Android device as Google Chrome (versions prior to 155.0.8059.39), combined with social engineering to make the victim interact with a crafted PDF; the incorrect authorization (CWE-863) in Chrome's PDF handling then allows the co-installed app to read sensitive information. Limiting factors: this is effectively a local attack despite the AV:N notation - it cannot be performed purely remotely, it depends on the attacker getting a separate app onto the device, it requires victim interaction (social engineering, contradicting the input's UI:N), and impact is confined to confidentiality (no integrity or availability effect). These constraints, plus CISA SSVC Automatable=no, mean real-world exploitation is targeted and non-trivial.

The signals here point to a genuine but low-urgency issue rather than a top priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) yields 5.9 (Medium) and nominally describes an unauthenticated network attack, but this directly conflicts with the description, which characterizes a LOCAL attacker who must have a malicious app co-installed on the same Android device and must employ social engineering - i.e., the real vector is local with user interaction, not a clean remote exploit (verify vector with vendor; AV:N and UI:N appear to overstate reachability). CISA SSVC reinforces the low-urgency read: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public exploit identified, so there is no evidence of active or opportunistic exploitation. The only serious dimension is confidentiality (C:H in the input, information disclosure of sensitive data), with no integrity or availability impact. Net: a legitimately patchable Medium-severity information-disclosure flaw that is hard to weaponize at scale (requires local app presence plus social engineering), so it should be remediated via normal Chrome update cadence rather than emergency patching.

An attacker convinces an Android user to install a seemingly benign app that is co-installed alongside Chrome, then uses social engineering to get the victim to interact with a crafted PDF. The incorrect authorization in Chrome's PDF handling lets the co-installed app read sensitive information it should not be able to access. No public exploit code has been identified, and exploitation is not automatable (CISA SSVC: Automatable=no).