Google Chrome CVE-2026-106390

Exploitation requires the victim to load attacker-controlled web content (UI:R in the CVSS vector) in an unpatched Chrome build prior to 155.0.8059.39 that exercises the SanitizerAPI; the crafted HTML page must invoke the API's mis-specified functionality to trigger the leak. No authentication or privileges are needed (PR:N), but the mandatory user interaction and the information-disclosure-only impact (C:L, no integrity/availability effect) substantially limit real-world risk. There is no indication a special non-default configuration is required beyond normal browser use.

This is a low-priority issue despite a network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) describes a remote, unauthenticated flaw that requires user interaction (victim must visit a crafted HTML page) and yields only low confidentiality impact with no integrity or availability effect - consistent with the vendor's 'Low' severity rating and the SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial). All signals align toward low real-world urgency: there is no CISA KEV listing, no public exploit identified, and SSVC explicitly records no observed exploitation and non-automatable attacks. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The one amplifying factor is prevalence - Chrome is ubiquitous - but the information-only impact, mandatory user interaction, and absence of any exploitation evidence make this a patch-in-normal-cycle item rather than an emergency.

An attacker hosts or injects a crafted HTML page that abuses the SanitizerAPI's incorrect handling of specified functionality; when a victim using an unpatched Chrome build visits the page, sensitive information is leaked across a boundary it should not cross. No public exploit code has been identified, and success depends on the victim actively loading attacker-controlled content.