Google Chrome CVE-2026-106361

Exploitation requires the victim to be running Google Chrome on iOS at a version prior to 155.0.8059.39 and to be induced through social engineering (UI:R) to visit or interact with attacker-influenced web content, after which crafted network traffic triggers the web-origin-policy bypass. No authentication or elevated privileges are needed (PR:N), and the affected behavior is present in default configurations of the mobile browser - there is no special feature toggle noted. The principal limiting factor is the mandatory user interaction: the attack cannot succeed opportunistically or at scale without a user being convinced to engage, which is why CISA SSVC rates it non-automatable. Impact is limited to integrity (crossing origin boundaries); it does not directly expose confidential data or cause denial of service.

This is a genuinely Medium-severity issue, and the multiple signals here are consistent rather than conflicting. The CVSS 3.1 vector (6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) describes a network-reachable, low-complexity, unauthenticated flaw whose impact is confined to integrity (I:H) with no confidentiality or availability loss - consistent with a web-origin-policy bypass where an attacker can cross security boundaries but the primary damage is unauthorized cross-origin action/data manipulation rather than direct data theft. The requirement for user interaction (UI:R), explicitly described as 'leveraging social engineering,' meaningfully limits mass exploitation. Corroborating signals align: EPSS is low (0.21%, 11th percentile), and CISA's SSVC decision framework rates Exploitation as 'none,' Automatable as 'no,' and Technical Impact as 'partial' - all pointing to a non-automatable, interaction-dependent issue rather than a wormable or opportunistically scanned one. There is no KEV listing and no indication of public exploit code. Net assessment: a real but routine browser-hardening fix that should be remediated on a normal patch cadence, not an emergency. It is not a high-CVSS-but-illusory issue, but neither is it a priority-one threat. One caveat: the CWE (CWE-684, incorrect provision of specified functionality) and the 'Authentication Bypass' tag are a loose fit for a same-origin/web-origin policy bypass - treat the mechanism as origin-policy enforcement failure, not credential/auth bypass.

An attacker lures a Chrome-for-iOS user (via a malicious link, ad, or message - the social-engineering element) to a web page under attacker influence, then sends crafted network traffic that causes Chrome to mishandle web origin enforcement. This lets attacker-controlled content act across an origin boundary it should not reach, enabling cross-origin actions against sites the victim is using. No public exploit identified at time of analysis, and exploitation requires the victim to take the bait, limiting scale.