Google Chrome CVE-2026-106329

Exploitation requires the victim to actively open attacker-controlled content: per the description the attacker leverages social engineering to get the user to load a crafted HTML page (CVSS UI:R), so there is no drive-by/zero-click path. No authentication or prior privileges are needed (PR:N). The affected surface is Chrome's FileSystem component with an incorrect authorization (CWE-863) defect; the vulnerability affects Chrome builds prior to 155.0.8059.39 on the desktop stable channel. The primary limiting factors are the mandatory user interaction and the need for the user to be running a pre-155.0.8059.39 version; SSVC rates the attack as not automatable, consistent with the human-in-the-loop requirement reducing mass-exploitation feasibility.

This is a genuinely high-priority vulnerability by technical severity, but exploitation signals are presently quiet. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes a network-reachable, low-complexity, unauthenticated flaw requiring only user interaction, with a scope change reflecting a sandbox escape and total confidentiality/integrity/availability impact - consistent with the description of out-of-sandbox arbitrary code execution. The CISA SSVC framework corroborates the ceiling (Technical Impact: total) but tempers urgency: Exploitation is 'none' (no observed active exploitation) and Automatable is 'no' (mandatory social-engineering/user-interaction step defeats mass automated exploitation). No EPSS score was supplied, KEV status is not indicated (consistent with SSVC Exploitation:none, i.e. not actively exploited), and no POC is referenced. So the signals are consistent rather than conflicting: catastrophic potential impact, but no evidence of in-the-wild use and a human-interaction requirement that limits scalability. Net: patch promptly given Chrome's ubiquity and the RCE+sandbox-escape impact, but this is not currently an emergency 0-day. Note the UI:R requirement means the 9.6 overstates real-world ease relative to a drive-by with no interaction.

An attacker crafts a malicious HTML page that abuses the incorrect authorization check in Chrome's FileSystem component and lures a victim into visiting it via phishing or a malicious link (the required social-engineering/user-interaction step). When the page loads, the flaw lets the attacker escape the renderer sandbox and execute arbitrary code on the host with the browser's privileges. No public exploit code is identified at time of analysis, and the attack cannot proceed without the victim opening the attacker-controlled content.