Google Chrome CVE-2026-106402

Exploitation requires the attacker to (1) build a crafted Chrome extension and (2) use social engineering to get the victim to install it in Chrome versions prior to 155.0.8059.39; the installed extension then leverages incorrect authorization in the Extensions component to spoof UI elements. Limiting factors: the victim must actively install an untrusted extension (bypassing Chrome Web Store/enterprise install controls and user warnings), the attack is complex (CVSS AC:H), and impact is confined to deceptive UI spoofing rather than code execution or direct data compromise. Environments that restrict extension installation via enterprise policy are largely protected.

This is a genuinely low-to-moderate priority issue despite being network-reachable. The provided CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L, base 4.8) scores it Medium, consistent with Chromium's own 'Medium' severity rating and CWE-863 (Incorrect Authorization). The high attack complexity (AC:H) and the description's reliance on social engineering materially reduce real-world exploitability. CONFLICT TO VERIFY: the CVSS vector sets UI:N (no user interaction), yet the description explicitly states the attack requires 'social engineering' and 'a crafted Chrome extension' - i.e., the victim must be convinced to install an attacker-controlled extension. That is user interaction, so UI:N appears understated; treat the attack as interaction-dependent rather than fully automatic. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The impact is UI spoofing (deceptive interface), not code execution or data theft, further limiting severity. Net: a real but low-urgency bug; patch in the normal Chrome update cycle rather than emergency response.

An attacker publishes or sideloads a crafted Chrome extension and uses social engineering (phishing, fake 'required plugin' prompts) to persuade a victim to install it. Once installed, the extension abuses incorrect authorization to spoof trusted browser UI elements, deceiving the user into trusting attacker-controlled content or actions. No public exploit code was identified at time of analysis.