Chrome for iOS CVE-2026-106397

Requires the victim to open an attacker-crafted HTML page in Google Chrome for iOS on a version prior to 155.0.8059.39; exploitation is driven by social engineering (UI:R), so the user must be lured into navigating to or interacting with the malicious content. No authentication is required (PR:N), but the mandatory user-interaction step and the version constraint (patched builds are unaffected) are the primary limiting factors. Impact is bounded to Low confidentiality and Low integrity with a scope change (S:C), meaning it crosses a trust/authorization boundary but does not grant availability impact; there is no indication a non-default configuration is needed.

Signals converge on this being a genuine-but-low-priority issue rather than an urgent threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1 Medium) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction, with only Low confidentiality and Low integrity impact and a changed scope. EPSS is very low at 0.18% (7th percentile), and there is no CISA KEV listing and no identified public exploit - so exploitation status is 'no public exploit identified at time of analysis.' CISA SSVC reinforces this: Exploitation=none and Automatable=no (consistent with the required social-engineering/user-interaction step). One notable conflict: SSVC rates Technical Impact as 'total,' which contradicts the CVSS impact sub-scores of C:L/I:L/A:N (partial, not total) - this discrepancy should be verified with the vendor, as the Chromium team rated the bug Medium, favoring the partial-impact reading. Net: a real, patchable defense-in-depth flaw worth routine remediation, not an emergency, given low exploitation probability, no known exploitation, and the mandatory user-interaction gate.

An attacker crafts a malicious HTML page and uses social engineering (phishing link, malicious ad, or messaging lure) to get an iOS Chrome user to open it. When rendered by a vulnerable Chrome for iOS build (< 155.0.8059.39), the page triggers an incorrect-authorization condition that bypasses system access restrictions. No public exploit code or active exploitation is identified at time of analysis, and the low complexity is offset by the requirement that the victim interact with the attacker-controlled page.