Google Chrome CVE-2026-106376

Exploitation requires a victim running Google Chrome on Windows prior to 155.0.8059.39 to actively load attacker-controlled web content (UI:R) that exercises the ANGLE graphics backend; no authentication is required (PR:N). The primary limiting factors are the mandatory user interaction (the victim must visit/render a crafted HTML page) and the fact that the outcome is a bounded memory read (C:L, no integrity or availability impact), making this useful chiefly as an information-disclosure/sandbox-leak primitive rather than direct code execution. It affects default configurations - no special feature toggle is required beyond normal hardware-accelerated graphics via ANGLE.

This is a genuine but low-urgency issue, not a drop-everything priority. The CVSS 3.1 base score of 4.7 (Medium) is driven by AV:N/AC:L/PR:N (network-reachable, low complexity, no authentication) but held down by UI:R (the victim must open attacker-controlled content), a confidentiality-only impact (C:L/I:N/A:N), and the fact that it only leaks memory. The S:C (scope change) reflects that the uninitialized-memory read crosses the renderer sandbox boundary, which is why Google rates the Chromium severity as High even though the numeric CVSS is Medium - an info leak that defeats the sandbox is valuable as one link in an exploit chain rather than as a standalone compromise. All exploitation signals point the same way: EPSS is 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data, so there is no evidence of active or imminent exploitation. No SSVC decision data was supplied. The signals are therefore consistent (low CVSS, low EPSS, no KEV, no POC), with the only tension being Google's internal 'High' rating versus the Medium CVSS - this is normal for sandbox-boundary info leaks and does not imply hidden risk. Treat as routine patch-cycle remediation.

An attacker hosts or injects a crafted HTML page that drives Chrome's ANGLE graphics layer into reading uninitialized memory; when a victim browses to the page, residual process memory contents are leaked back to the attacker. Because exploitation requires the user to load the malicious page (UI:R) and yields only a memory read, it is most plausible as a reconnaissance/info-leak primitive feeding a larger sandbox-escape chain. No public exploit code was identified at time of analysis.