Google Chrome CVE-2026-106348

Exploitation requires the victim to use an affected Google Chrome build (prior to 155.0.8059.39) and to load an attacker-crafted HTML page in that browser - this user-interaction requirement (UI:R) is the primary limiting factor; there is no authentication requirement (PR:N) and no special non-default browser configuration is indicated. The flaw is reached through the browser's Animation rendering path, so it triggers against default Chrome configurations as soon as the malicious page is rendered, but it cannot be exploited without that victim-initiated page load. Impact is limited to disclosure of sensitive information (confidentiality only); it does not by itself modify data or crash the browser.

Signals are consistent and point to a genuine but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity, unauthenticated flaw whose only real friction is required user interaction (UI:R) - the victim must load attacker-controlled content. Impact is confidentiality-only (C:H, I:N, A:N), matching the CWE-200 information-disclosure classification and the 'Information leak in Animation' description. Exploitation likelihood signals are LOW and aligned: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data - so this is confirmed no public exploit identified at time of analysis, not active exploitation. Google rates it Medium severity internally, consistent with the memory-disclosure (not RCE) nature. Net: a real, patch-worthy browser vulnerability affecting an extremely widely deployed product, but currently a routine-patch priority rather than an emergency; its risk ceiling is bounded by the need for user interaction and the confidentiality-only impact. No conflicting signals were observed in the data.

An attacker hosts a malicious web page containing crafted HTML/CSS that abuses the Animation component, then lures a Chrome user (versions before 155.0.8059.39) to visit it via a link, ad, or compromised site. When the page renders, the flaw leaks sensitive in-process memory contents (e.g., cross-origin data or memory layout) back to attacker-controlled script. No public exploit code was identified in the provided data, and success requires the victim to actually open the page (UI:R).