Google Chrome CVE-2026-106359

Exploitation requires the victim to use an unpatched Chrome build prior to 155.0.8059.39 and to actively visit an attacker-controlled web page containing crafted HTML (UI:R), which is the sole triggering vector against default configurations - no special Chrome setting or non-default feature is named in the description. No authentication or prior privilege is required of the attacker (PR:N), and no victim credentials are needed to serve the page. Limiting factors that reduce realistic risk: mandatory user interaction (the victim must navigate to the page), impact confined to an integrity-only web-origin-policy bypass within the DeviceBoundSessionCredentials component (C:N/A:N, scope unchanged), and the narrow nature of the confused-deputy condition rather than arbitrary code execution.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) yields 4.3 and reflects a network-reachable but user-interaction-dependent flaw with only limited integrity impact and no confidentiality or availability impact - Google's own Chromium rating of 'Low' agrees. EPSS reinforces this: 0.24% probability at the 13th percentile indicates very low near-term exploitation likelihood. The vulnerability is NOT in CISA KEV and there is no public exploit identified at time of analysis, so there is no evidence of active exploitation or weaponization. The one factor that elevates real-world exposure is prevalence - Chrome is ubiquitous - but the combination of required user interaction, unchanged scope, and integrity-only impact (a web-origin/same-origin policy bypass rather than code execution or data theft) keeps the practical risk modest. This is a legitimately low-severity, high-CVSS-it-is-not case: patch on your normal Chrome update cadence rather than as an emergency.

An attacker hosts a malicious web page and lures a Chrome user to visit it; the crafted HTML triggers a confused-deputy condition in the DeviceBoundSessionCredentials component that causes Chrome to act across web origins it should keep separated, bypassing origin policy to tamper with or misuse session-bound credential handling. No public exploit code is identified, and the attack requires the victim to actively load the attacker's page (UI:R).