Google Chrome CVE-2026-106398

Exploitation requires the attacker to get a victim to load a crafted HTML page in a vulnerable Chrome build (prior to 155.0.8059.39); the flaw lives in the Media component's authorization handling, so attacker-controlled media/resource loading within that page is the trigger. The primary limiting factor is the mandatory user interaction (UI:R) - the victim must actively visit or render the malicious page; there is no server-side or zero-click path indicated. Impact is bounded to limited cross-origin confidentiality disclosure (C:L, I:N, A:N) - no code execution, data modification, or denial of service. No special non-default Chrome configuration is indicated; default installations are affected until updated.

This is a genuinely moderate-risk issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (victim must load a crafted HTML page) and yields only limited confidentiality impact (cross-origin data leak) with no integrity or availability impact. These signals are mutually consistent and corroborated by Chromium's own 'Medium' severity rating. The SSVC decision framework reinforces a non-urgent posture: Exploitation=none (no observed exploitation), Automatable=no, Technical Impact=partial. The CVE is NOT in CISA KEV and no public POC is referenced, so there is no evidence of active exploitation or weaponization. No EPSS score was provided in the input, which is a gap; absent that, the combination of 'medium' Chromium severity, user-interaction requirement, and confidentiality-only impact points to a real-but-routine browser patch rather than a high-priority incident. The one caveat worth flagging: cross-origin data leaks defeat the same-origin policy, which is a meaningful security boundary, so a reasonable analyst could argue for a scope-changed (S:C) rating - NVD/CVSS here kept S:U, which somewhat understates the trust-boundary crossing. Treat this as standard Chrome-patch hygiene.

An attacker hosts or injects a crafted HTML page and lures a victim into visiting it (e.g., via a link, ad, or compromised site). When the page loads, the Media component's incorrect authorization check lets attacker-controlled script read data belonging to another origin, leaking cross-origin content such as media/resource data the attacker should not be able to see. No public exploit code was identified at the time of analysis, and successful exploitation hinges on the victim rendering the malicious page.