Google Chrome CVE-2026-106365

Exploitation requires the victim to actively load an attacker-controlled HTML page in Chrome (UI:R / user interaction), which is the primary limiting factor - there is no fully passive, zero-interaction path. No authentication to any service is required (PR:N), and default Chrome configurations prior to 155.0.8059.39 are affected, so no special feature flag or non-default setting is needed. Exploitation is bounded to Chrome browser instances on the vulnerable version range and does not affect server-side components. The practical limiter is therefore social-engineering success in getting a user to visit the malicious page plus the browser remaining unpatched.

This is a genuine but moderate-priority issue, not a top-tier emergency. The vendor CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, 6.5 Medium) indicates a network-reachable flaw that an unauthenticated attacker can trigger with low complexity but ONLY if the victim is lured to a crafted HTML page (UI:R). Impact is confined to integrity (I:H) via a same/web-origin policy bypass in Chrome's Animation component - no direct confidentiality (C:N) or availability (A:N) impact is claimed by Google, consistent with its own 'Medium' Chromium severity rating. All exploitation signals point AWAY from urgency: EPSS is only 0.20% (9th percentile), there is no CISA KEV listing, and no public POC was identified, so this is 'no public exploit identified at time of analysis.' No SSVC decision record was provided. One point worth verifying: a 'web origin policy bypass' typically enables cross-origin data theft, which would normally imply a confidentiality impact, yet the vector rates C:N and I:H - this C/I split should be confirmed against Google's advisory, as the real-world effect (e.g., leaking or manipulating cross-origin content) may be broader than a pure integrity label suggests. Overall: patch in the normal browser-update cycle; it does not warrant out-of-band emergency response absent exploitation evidence.

An attacker hosts a malicious web page and lures a Chrome user (via phishing link, malvertising, or compromised site) to visit it. The crafted page abuses a missing authorization check in the Animation component to bypass the web origin policy, allowing the attacker's origin to influence or access resources it should not. No public exploit code was identified, and successful attack requires the victim to open the page.