Google Chrome CVE-2026-106392

Exploitation requires the WebAudio API code path in Chrome versions prior to 155.0.8059.39, and the victim must actively navigate to or load an attacker-controlled crafted HTML page (UI:R) - there is no fully passive or server-side trigger. No authentication is required (PR:N) and no special non-default browser configuration is indicated; the WebAudio API is enabled by default. The principal limiting factors are the mandatory user interaction, the confidentiality-only and partial impact (a cross-origin data leak, not code execution or full data disclosure), and the need for the user to run a pre-patch Chrome build before auto-update applies the fix.

Signals are consistent and point to a genuine but low-to-moderate priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable, low-complexity, unauthenticated flaw whose only impact is a partial loss of confidentiality (C:L) with no integrity or availability impact - matching the 'information leak' description and CWE-200. The requirement for user interaction (UI:R - the victim must open a crafted HTML page) meaningfully constrains exploitation. CISA's SSVC decision framework corroborates the low urgency: Exploitation=none, Automatable=no, Technical Impact=partial, which aligns with a cross-origin data leak rather than code execution. There is no CISA KEV listing and no public exploit code identified, and no EPSS score was provided in the input, so exploitation probability cannot be quantified numerically - however, the SSVC 'Exploitation: none' value and Chromium's self-assigned Medium severity both indicate no observed in-the-wild activity. There is no conflict among the signals: all sources agree this is a Medium-severity, confidentiality-only browser flaw. The main caveat is the missing EPSS value, so probabilistic exploitation likelihood is an inference from SSVC/KEV absence rather than a measured figure.

An attacker hosts a malicious web page that abuses the WebAudio API to read audio-processing state that reflects data from a different origin. When a victim is lured into visiting the page in a vulnerable Chrome build (prior to 155.0.8059.39), the page infers or extracts small amounts of cross-origin information (partial confidentiality impact). No public proof-of-concept exploit has been identified at the time of analysis, and success depends on the victim actively loading the attacker's page.