Google Chrome CVE-2026-106380

Exploitation requires the victim to visit an attacker-crafted HTML page in Chrome versions prior to 155.0.8059.39 AND to be successfully deceived through social engineering into trusting the spoofed UI elements. The limiting factors are significant: mandatory user interaction (UI:R) means the attack cannot succeed passively or at scale, and it relies on convincing social engineering rather than any technical bypass. The flaw affects default Chrome configurations (no special feature or non-default setting is named in the description), but impact is confined to UI deception on the affected desktop browser build; patched versions are not vulnerable.

This is a low-severity UI spoofing flaw (CWE-451) that the signals consistently rank as a low real-world priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U, base 5.4) indicates a network-reachable, unauthenticated, low-complexity issue, but crucially requires user interaction (UI:R) - the victim must be lured to and act on a crafted HTML page. Google/Chromium itself rated the security severity 'Low'. The SSVC decision framework reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no (requires per-victim social engineering, cannot be mass-scripted), Technical Impact=partial. There is no CISA KEV listing and no public POC reported, so exploitation status is 'no public exploit identified at time of analysis.' EPSS was not provided in the input, so exploitation probability cannot be quantified here. One inconsistency to flag: the input CVSS impact metrics (C:L/I:N/A:L) do not align well with a pure UI-misrepresentation/spoofing weakness, which is fundamentally an integrity-of-display issue rather than a confidentiality or availability one - verify impact mapping with the vendor advisory. Net assessment: genuinely low priority despite the ubiquity of Chrome, because the defect enables deception rather than code execution or data theft and depends entirely on successful social engineering.

An attacker crafts a malicious HTML page and, using social engineering (e.g., a phishing link), lures a Chrome user to visit it. The page manipulates browser UI elements so that spoofed content (such as a forged address bar, dialog, or security indicator) appears legitimate, tricking the victim into trusting fraudulent information or taking an unsafe action. No public exploit code is identified at time of analysis, and the attack requires the user to visit and interact with the attacker-controlled page.