Google Chrome CVE-2026-106336

Exploitation requires the victim to actively visit or load an attacker-controlled (or compromised) HTML page in Chrome - this user-interaction requirement (UI:R) is the primary limiting factor, as the attack is not self-propagating and cannot fire without a page load. The specific prerequisite is the ability to render crafted markup that drives the Paint component into an observable discrepancy (CWE-203 side channel), and the leak is confined to cross-origin data the browser already processes. The flaw affects default Chrome configurations prior to 155.0.8059.39 with no special feature or configuration toggle required (PR:N, AC:L), but impact is bounded to confidentiality disclosure (C:L) with no integrity or availability effect; patching to 155.0.8059.39 or later removes the condition entirely.

All signals point to a genuinely low-to-moderate priority issue despite Chrome's ubiquity. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless REQUIRES user interaction (UI:R - the victim must open a crafted page) and yields only limited confidentiality impact (C:L) with no integrity or availability effect. Chromium itself rated it Medium severity. There is no CISA KEV listing and no EPSS score was provided in the input, and no public exploit was referenced, so exploitation status is 'no public exploit identified at time of analysis.' The CWE-203 (observable discrepancy / side-channel) nature means exploitation leaks data probabilistically through timing/rendering observation rather than granting direct access, which typically keeps real-world EPSS probabilities low. No conflicting signals are present, but note two gaps: EPSS and POC status are absent from the input (not confirmed either way), so the 'low real-world risk' conclusion rests on CVSS metrics and the side-channel CWE rather than on exploitation telemetry. This is a patch-in-normal-cycle item, not an emergency - elevated only by Chrome's enormous install base, not by exploit pressure.

An attacker hosts or compromises a web page containing crafted markup that triggers an observable discrepancy in Chrome's Paint subsystem. When a victim is lured into visiting the page, the attacker's JavaScript observes rendering/timing side effects to infer and exfiltrate cross-origin data the victim's browser can see but the page's origin should not. No public exploit code was identified in the provided intelligence.