Google Chrome CVE-2026-106354

Exploitation requires the victim to open an attacker-controlled or attacker-injected crafted HTML page in a vulnerable Chrome build prior to 155.0.8059.39 (UI:R), and the leak is scoped to Chrome's Extensions resource-exposure weakness rather than arbitrary cross-origin access; limiting factors are the required user interaction (visiting the page), the confidentiality-only, low-severity impact (C:L, I:N, A:N), and the narrow fixed-version window - users on 155.0.8059.39 or later are not affected. No elevated privileges or prior authentication are required (PR:N).

This is a genuine-but-moderate priority issue whose signals align consistently toward the lower end. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (victim must open a crafted HTML page) and yields only low confidentiality impact with no integrity or availability effect - consistent with the description of cross-origin data disclosure via Chrome's Extensions component. Chromium's own severity rating of Medium matches this. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so per the data this is 'no public exploit identified at time of analysis' and there is no evidence of active exploitation. The absence of EPSS/KEV/POC is expected for a freshly disclosed browser Medium-severity bug and should not be read as a contradiction; it simply means exploitation likelihood cannot be quantified from the inputs. The main real-world driver of risk here is Chrome's enormous install base rather than the per-instance severity: a low-impact cross-origin leak is far less urgent than an RCE, but the ubiquity of the product warrants prompt patching. Verify affected-version detail with the vendor, as the EUVD version string ('Chrome 155.0.8059.39 <155.0.8059.39') is malformed/self-referential and only the fixed version (155.0.8059.39) is reliable.

An attacker hosts or compromises a web page containing crafted HTML that abuses the improper resource exposure in Chrome's Extensions handling. When a victim running a pre-155.0.8059.39 Chrome build visits the page, the page reads data belonging to a different origin that should have been isolated, disclosing it to the attacker. No public exploit code was identified at the time of analysis, and the attack depends on the victim loading the malicious page (UI:R).