Google Chrome CVE-2026-106367

Exploitation requires a malicious co-installed application present on the same Android device as Chrome (versions prior to 155.0.8059.39), plus successful social engineering to get the victim to install that app and/or perform an action. The missing authorization check is what the co-installed app abuses to reach outside the browser sandbox. Limiting factors: the attacker needs local presence via an installed app (no remote network vector), the attack is Android-specific, and user interaction/social engineering is required - meaning default, lone Chrome installations without an attacker-controlled companion app are not directly exploitable. This substantially narrows realistic exploitation compared to the raw 8.4 score.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) yields a base score of 8.4 and describes an unauthenticated, no-interaction local attack with full confidentiality, integrity, and availability impact. However, this vector directly conflicts with the description, which states the attack requires a 'local attacker leveraging social engineering' and 'a co-installed app' - both strongly imply user interaction (UI:R, not UI:N) and some victim action, so the published 8.4 likely overstates ease of exploitation; verify with vendor. Chromium itself rated this only 'Medium' severity, which is more consistent with a local, interaction-dependent sandbox-escape-adjacent issue than with a wormable critical flaw. The EPSS score is very low (0.12%, 2nd percentile), the CVE is NOT in CISA KEV, and no public exploit is indicated - so despite the high CVSS number, real-world mass-exploitation risk is currently low. Net assessment: this is a high-CVSS-but-modest-real-risk issue in practice, requiring local access plus a malicious co-installed app and user manipulation; it is a real priority for patching given Chrome's ubiquity on Android, but it is not an actively-exploited emergency based on available signals.

An attacker convinces an Android user, through social engineering, to install a malicious companion app alongside Chrome. The malicious app abuses the missing authorization check to interact with Chrome and break out of the browser sandbox, potentially executing arbitrary code with the browser's privileges. No public exploit code is identified at time of analysis, and the attack depends on the victim installing the attacker's app.