Google Chrome CVE-2026-106356

Exploitation requires the attacker to deliver a specially crafted HTML page (via phishing, malicious link, or compromised site) AND the victim to visit and actively interact with (click) the spoofed/overlaid UI elements - this user interaction (UI:R) is the primary limiting factor. No authentication or elevated privileges are needed (PR:N), and it works against default Chrome configurations below 155.0.8059.39, but the dependence on successful social engineering substantially limits realistic impact; there is no code execution or data exfiltration, only UI deception.

This is a genuinely low-to-moderate priority issue despite the CVSS 5.4 'Medium' rating. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms remote, unauthenticated, low-complexity reach, but the mandatory user interaction (UI:R) and the clickjacking nature (CWE-1021) mean impact hinges entirely on successful social engineering rather than any direct technical compromise. No EPSS score is provided, so exploitation probability cannot be quantified; there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active or opportunistic exploitation. Conflicting signal to note: Chrome's assigned impact of C:L/I:N/A:L is atypical for a pure UI-spoofing/clickjacking flaw, where the harm is deception (an integrity concern) rather than confidentiality or availability loss - this discrepancy should be verified against the vendor's rationale. Net: a defense-in-depth browser hardening fix, not an emergency patch, though Chrome's ubiquity means it should be rolled out via normal auto-update cycles.

An attacker crafts a malicious HTML page that overlays or frames Chrome UI elements to deceive the victim, then lures the user to it via phishing or a malicious link. When the victim interacts with what appears to be a legitimate interface element, they are tricked into performing an unintended action. No public exploit code has been identified, and success depends entirely on the victim being socially engineered into visiting and interacting with the page.