Google Chrome CVE-2026-106388

Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process (typically via a separate memory-corruption or sandbox bug) before this missing-authorization flaw in the DataTransfer component can be abused. The victim must then load attacker-controlled crafted HTML (UI:R - user interaction required). This is therefore a chained/secondary vulnerability, not a standalone remote primitive; the pre-existing renderer compromise and the high attack complexity (AC:H) are the key factors limiting realistic exploitation. Affected: Google Chrome desktop prior to 155.0.8059.39; fixed in the stable channel update.

This is a medium-severity information-disclosure flaw whose real-world priority is low despite a network-facing CVSS of 5.3. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) advertises no privileges, but this directly conflicts with the description, which states the attacker must have ALREADY compromised the renderer process - meaning this is a secondary/chained bug, not a standalone remote primitive. That precondition is the dominant risk-limiting factor and is only partially captured by the AC:H (high complexity) metric; treat PR:N here with skepticism. All exploitation signals point low: SSVC reports Exploitation=none, Automatable=no, Technical Impact=partial; there is no CISA KEV listing and no public exploit identified at time of analysis. EPSS was not provided in the input, so probabilistic exploitation likelihood is unknown. Impact is confidentiality-only (I:N/A:N) with scope unchanged. Net: a genuine but constrained info-leak that matters chiefly as a post-renderer-compromise escalation step, not an independently high-priority issue - patch via normal Chrome update cadence.

An attacker who has already exploited a separate renderer bug lures the victim to a crafted HTML page; the page abuses the missing authorization check in DataTransfer to read sensitive information the renderer should not be able to access. No public exploit is known, and success depends on first achieving renderer compromise, so this functions as an information-leak link in a larger exploit chain rather than a standalone attack.