Google Chrome CVE-2026-106369

Exploitation requires the attacker to have ALREADY compromised a Chrome renderer process (e.g., via a separate memory-corruption or logic bug) - this is the primary gating prerequisite and is stated explicitly in the description. Beyond that, exploitation targets the Translate feature and is delivered through a crafted HTML page, and the CVSS vector requires user interaction (UI:R, i.e., the victim must navigate to the attacker-controlled page) and reflects high attack complexity (AC:H). The flaw's purpose is to bypass Chrome's site isolation; it does not grant initial access and is not exploitable against an un-compromised renderer. These factors - mandatory prior renderer compromise, required user interaction, and high complexity - sharply limit realistic risk despite the network attack vector.

This is a genuinely low-priority issue despite the 'High' Chromium severity label, which reflects potential impact within Chrome's security model rather than real-world exploitability. The CVSS 3.1 score of 4.2 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) is the dominant signal: high attack complexity, required user interaction, and only low confidentiality and integrity impact with no availability impact. Critically, the description states exploitation requires an attacker 'who had compromised the renderer process' - meaning this is a chaining/escalation bug (a site-isolation bypass) that is not independently exploitable and presupposes a prior full renderer compromise. EPSS corroborates low urgency at 0.19% (8th percentile), indicating very low probability of exploitation activity. There is no CISA KEV listing and no public exploit code identified, so there is no evidence of active or imminent exploitation. The signals are consistent rather than conflicting: low CVSS, low EPSS, no KEV, no POC all point the same direction. Note one framing nuance to verify: the CVSS vector encodes PR:N, but the description's precondition (a compromised renderer) means practical exploitation is gated behind a separate, non-trivial foothold - so the raw PR:N can overstate how reachable this is in isolation.

An attacker first achieves code execution in a Chrome renderer process through a separate vulnerability, then lures the user to a page they control that serves a crafted HTML payload. Leveraging the missing authorization check in the Translate feature, the compromised renderer uses the crafted page to cross site-isolation boundaries and access data belonging to another origin. No public exploit code is known, and the high attack complexity plus the prerequisite renderer compromise make this a post-exploitation escalation primitive rather than a standalone attack.