Google Chrome CVE-2026-106346

Exploitation requires the victim to load attacker-controlled content (crafted HTML page) in Chrome versions prior to 155.0.8059.39, triggering the vulnerable DevTools state-validation path (UI:R). No authentication is required (PR:N) and the attack is network-delivered (AV:N). Critical limiting factors: (1) mandatory user interaction (visiting/opening the malicious page), which prevents automated or wormable exploitation and is why SSVC marks Automatable=no; (2) resulting code execution is confined to the renderer sandbox (S:U), so full host compromise would require an additional sandbox-escape primitive not described here; (3) only unpatched Chrome builds below 155.0.8059.39 are affected, and auto-update rapidly reduces the exposed population.

Signals are moderately consistent and point to a serious-but-not-emergency browser flaw. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated issue that requires user interaction (visiting a crafted HTML page). CISA's SSVC framing aligns and tempers urgency: Exploitation=none (no observed exploitation), Automatable=no (user interaction breaks mass/automated exploitation), Technical Impact=total. The CVE is NOT in CISA KEV and no POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified. One important nuance the raw 8.8 obscures: the description states code executes 'inside the sandbox,' i.e. this is sandboxed code execution via DevTools state confusion, not a confirmed full sandbox escape - absent a chained renderer/sandbox-escape bug, real-world impact is contained to the compromised renderer process. Net: a legitimate High-severity patch-now item for a ubiquitous product, but not a drop-everything 0-day given no exploitation evidence, required user interaction, and sandbox containment. Verify whether any companion sandbox-escape CVE shipped in the same Chrome 155.0.8059.39 release before downgrading priority.

An attacker hosts or compromises a web page containing crafted content that abuses an improper state-validation flaw in Chrome's DevTools, then lures a victim into visiting it. When the page loads and the vulnerable DevTools code path is triggered, the attacker achieves arbitrary code execution within the renderer sandbox. No public exploit code is referenced, and the attack depends on the victim opening the malicious page (UI:R).