Google Chrome CVE-2026-106337

Exploitation requires the victim running Chrome on Android (versions prior to 155.0.8059.39) to actively navigate to an attacker-crafted HTML page (UI:R) - it cannot be triggered against a passive or idle browser. No authentication is required (PR:N, unauthenticated) and no special Chrome configuration is needed since the defect is in default UI rendering, but the attacker gains no code execution or direct data read: the sole effect is visually misrepresenting UI elements to deceive the user, so realized harm depends on the user being successfully tricked (e.g., into trusting a spoofed origin for phishing). The Android-only scope limits exposure on desktop Chrome.

This is a Medium-severity UI misrepresentation (UI spoofing, CWE-451) flaw in Google Chrome on Android, and the signals converge on a genuinely low-to-moderate priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, 5.4) shows network reach and no privileges, but exploitation requires user interaction (UI:R) - the victim must visit the attacker's crafted HTML page - and impact is limited (C:L/I:N/A:L, unchanged scope). CISA SSVC reinforces low urgency: Exploitation=none, Automatable=no, Technical Impact=partial. There is no KEV listing and no public exploit identified at time of analysis, so this is not confirmed to be actively exploited. No EPSS score was provided in the input, which is a data gap, but every available signal (SSVC exploitation=none, no KEV, no POC, spoofing-only impact) points to a low real-world exploitation likelihood. One minor inconsistency worth noting: the vendor vector assigns A:L (limited availability impact), which is unusual for a pure UI-spoofing issue where the primary consequence is deceiving the user rather than degrading availability - verify the availability rationale with the vendor advisory. Net: a real but low-priority defect best handled via routine Chrome auto-update rather than emergency patching.

A remote attacker crafts a malicious HTML page and lures an Android Chrome user to visit it (via link, ad, or compromised site); the page manipulates browser UI elements - such as the address bar, security indicators, or dialog overlays - to misrepresent the page's true origin. The victim, believing they are on a trusted site, is primed for phishing or credential capture. No public exploit code is identified at time of analysis, and the attack requires the user to navigate to the attacker-controlled page (UI:R).