Google Chrome CVE-2026-106330

Exploitation requires the victim to use an affected Google Chrome version prior to 155.0.8059.39 and to actively load a crafted HTML page under attacker control (UI:R) - this user-interaction requirement is the primary limiting factor, as the attack cannot be triggered passively or server-side. No authentication is required of the attacker (PR:N) and the attack is network-reachable via the web (AV:N), but no special victim-side configuration is needed since the flaw affects Chrome's default Paint rendering path. The narrow impact (partial information leak only) and Chrome's automatic update mechanism further limit realistic exposure.

This is a genuinely low-to-moderate priority issue despite being a Chrome vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) yields a base score of 4.3 (Medium), and Chromium itself rated it Medium severity - these signals agree. The impact is limited to a partial confidentiality breach (C:L) in the Paint component with no integrity or availability impact, consistent with CWE-200 information disclosure. Critically, exploitation requires user interaction (UI:R) - the victim must visit an attacker-controlled page. No EPSS score was provided in the input, the vulnerability is NOT on the CISA KEV list, and no public proof-of-concept was identified, so there is no public exploit identified at time of analysis. The reliance on user interaction, the merely partial information leak, and the absence of any exploitation evidence all point toward this being a high-ubiquity-product/low-real-risk issue rather than an urgent threat. The main mitigating reality is simply patch velocity: Chrome auto-updates, so the realistic window of exposure is short for most users.

An attacker hosts or compromises a web page containing specially crafted HTML that triggers the flaw in Chrome's Paint component, then lures a victim into visiting it (phishing link, malvertising, or compromised site). When the page renders, the flaw leaks sensitive in-memory information (e.g., process memory contents that could aid further attacks) back to attacker-controlled script. No public exploit code was identified, and successful exploitation depends on the user actually loading the malicious page.