Google Chrome CVE-2026-106405

Exploitation requires a malicious application to be co-installed on the same Android device as Google Chrome, and the attacker must win a race condition (TOCTOU, CWE-367) in the Chrome Custom Tabs component. Per the CVSS vector, the attacker needs local access (AV:L), some existing privileges (PR:L, i.e. the ability to install/run the co-installed app), and the attack depends on user interaction (UI:R) - typically the victim opening a link that invokes a Custom Tab. Limiting factors that reduce realistic risk: the co-installed-app prerequisite (the malicious app must already be present), the narrow and non-deterministic race window (high attack complexity), the requirement for user interaction, and the local-only vector - remote or unauthenticated exploitation is not possible. Only Chrome on Android versions prior to 155.0.8059.39 are affected.

This is a genuinely moderate-priority issue rather than an urgent one, and the signals are largely consistent in pointing that way. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:R) describes a hard-to-exploit local vulnerability: the attacker must already have a malicious app co-installed on the device, must win a race condition (AC:H), holds only limited privileges (PR:L), and requires user interaction (UI:R). These preconditions are reflected in the low EPSS score (0.09%, 0th percentile), indicating essentially no observed or predicted mass exploitation, and in the SSVC decision (Exploitation: none, Automatable: no), which argues against opportunistic or automated attacks. The one elevated signal is SSVC Technical Impact: total, consistent with the C:H/I:H rating - a successful origin-policy bypass can fully compromise the confidentiality and integrity of web content across origins. There is no KEV listing and no indication of public exploit code, so this is not actively exploited. Net: a medium-severity, high-impact-but-hard-to-reach flaw whose real-world risk is constrained by the co-installed-app and race-window requirements, not a drop-everything priority. One inconsistency to verify: the CVE description targets Chrome on Android, but the vendor reference links to the 'Stable Channel Update for Desktop' blog post - confirm the correct Android advisory with Google.

A user installs a malicious app alongside Chrome on an Android device. When the user opens a link that launches a Chrome Custom Tab, the malicious co-installed app exploits a time-of-check/time-of-use race condition during the Custom Tabs flow to bypass the web origin policy, allowing it to read or manipulate web content it should not have access to. No public exploit code is identified at time of analysis, and the attack depends on winning a timing window and on user interaction.