Google Chrome CVE-2026-106331

Exploitation requires the victim to install a crafted, attacker-controlled Chrome extension obtained through social engineering - the malicious extension is the exploitation vector, and the flaw is triggered when that extension abuses improper input validation in Chrome's Extensions handling to cross the web origin policy boundary into a privileged (e.g., chrome:// / WebUI) page. Limiting factors: mandatory user interaction (UI:R) to install and run the extension, dependence on tricking the user rather than any default-reachable network path, and the fact that Chrome's auto-update plus the vendor patch (155.0.8059.39) close the window; impact is confined to integrity (C:N/A:N), with no confidentiality loss or denial of service claimed.

This is a genuine but lower-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, base 6.5 MEDIUM) describes a network-reachable, unauthenticated, low-complexity integrity-only issue - but the UI:R flag and the description's explicit reliance on social engineering are the dominant real-world limiters, because the attacker must first convince a victim to install and interact with a malicious Chrome extension. Google/Chromium themselves rated the security severity 'Low', which aligns with the low exploitation signals: EPSS is 0.18% (7th percentile), there is NO CISA KEV listing and NO public POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' The signals are consistent rather than conflicting - moderate CVSS, very low EPSS, vendor 'Low' rating, and a mandatory user-interaction precondition all point the same direction. The one tension worth stating: CVSS is network-vector (AV:N) and PR:N (unauthenticated), which can read as 'remote unauth' danger, but the practical attack requires victim-side extension installation, so treat this as user-interaction-gated, not drive-by. Patch availability from Google plus Chrome's auto-update mechanism further reduce exposure window.

An attacker publishes or sideloads a crafted Chrome extension and uses social engineering (phishing, fake tooling, deceptive install prompt) to persuade a victim to install it. Once running, the extension exploits improper input validation to bypass the web origin policy and reach a privileged Chrome page, violating the integrity boundary. No public exploit code or active exploitation is currently identified.