Google Chrome CVE-2026-106360

Exploitation requires the victim to actively visit or load attacker-controlled content in Chrome (UI:R user interaction), and the leak is scoped to Chrome's Payments feature, so a victim with cross-origin payment-related data available in the browser session is the realistic target. No authentication or elevated privileges are needed on the attacker side (PR:N), and default configurations of Chrome prior to 155.0.8059.39 are affected - there is no indication a non-default setting is required. The principal limiting factors are the mandatory user interaction (no drive-by/zero-click path), the unchanged scope (S:U, confined to a single origin boundary), and that impact is confined to disclosure of cross-origin data (C:L) with no integrity or availability effect.

This is a genuinely low-to-moderate priority issue despite the NVD CVSS base score of 4.3, and the signals are internally consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) describes a network-reachable, low-complexity, unauthenticated bug that requires user interaction (visiting a crafted page) and yields only limited confidentiality impact with no integrity or availability effect - matching the 'Information leak' description and CWE-200. CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed exploitation), Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public exploit code referenced in the provided data, so this is not an active-exploitation scenario. Google self-rated the Chromium security severity as Medium, aligning with the limited cross-origin data disclosure. The main countervailing factor is prevalence: Chrome is ubiquitous, so even a medium-severity flaw has an enormous installed base. However, the need for user interaction, the single-origin scope (S:U), and the absence of any exploitation signal mean this should be patched through normal browser-update cadence rather than treated as an emergency.

An attacker hosts or compromises a web page containing crafted content that abuses a flaw in Chrome's Payments component; when a victim browses to that page, the page reads data belonging to another origin that the victim is authenticated to. No public proof-of-concept is referenced in the provided data, and exploitation is limited to information disclosure (C:L) with no code execution or data modification.