Google Chrome CVE-2026-106341

Exploitation requires the victim to use the Chrome desktop browser to navigate to attacker-controlled web content (UI:R) - there is no server-side or fully drive-by-without-interaction path, so phishing or a watering-hole/malvertising lure is a prerequisite. The affected component is V8, Chrome's default JavaScript/WebAssembly engine, so no non-default configuration is needed; any unpatched install below 155.0.8059.39 is exploitable. Key limiting factors: (1) required user interaction (opening the page); (2) code execution is confined to the renderer sandbox per the description, so full host compromise additionally requires a separate sandbox-escape vulnerability; (3) Chrome's auto-update mechanism rapidly shrinks the exposed population once the stable channel update propagates.

Signals are mostly consistent but point to a lower real-world priority than the 8.8 CVSS base score alone suggests. The CVSS vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (victim must open a crafted HTML page). CISA's SSVC framework reports Exploitation: none and Automatable: no, which aligns with the absence of a KEV listing and the absence of any public POC - there is no evidence of active or at-scale exploitation. Technical Impact: total matches the CWE-843 type-confusion-to-RCE outcome and the C:H/I:H/A:H impact metrics. A key mitigating factor the raw score obscures: the description explicitly states code execution occurs INSIDE the Chrome sandbox (consistent with S:U, no scope change), so a successful exploit must still be chained with a separate sandbox-escape bug to compromise the host - and Google itself rated the Chromium security severity only Medium, conflicting with the 8.8 (High) NVD-style base score. Net: a genuine memory-corruption RCE in an ubiquitous product that warrants prompt patching, but NOT an emergency given no exploitation signal, required user interaction, and sandbox containment. The gap between the Medium vendor rating and 8.8 CVSS High should be reconciled when prioritizing.

An attacker hosts or compromises a web page containing malicious JavaScript that triggers a type-confusion condition in Chrome's V8 engine. A victim browsing to that page with a vulnerable Chrome version (prior to 155.0.8059.39) causes attacker-controlled code to execute within the browser's renderer sandbox. No public exploit code has been identified at time of analysis, and the attacker would still need a separate sandbox-escape to affect the underlying system.