Google Chrome CVE-2026-106414

Exploitation requires the victim to actively open an attacker-crafted HTML page in Chrome (UI:R), typically delivered through social engineering such as a phishing or malicious link - there is no unauthenticated zero-click path. No special product feature or non-default configuration is named in the description; the trigger is simply rendering a malicious page. Limiting factors: required user interaction and reliance on social engineering reduce realistic exploitability, and the fix is already available in Chrome 155.0.8059.39, so unpatched/older mobile Chrome installations are the exposed population. Note the platform ambiguity: the description says iOS, where Chrome runs on Apple's WebKit, which may constrain whether a Chromium-style sandbox escape is actually reachable.

Signals conflict sharply and must be reconciled before prioritization. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) scores 9.6 Critical, driven by a scope change (sandbox escape) and full CIA impact, yet Chromium's own severity rating is 'Medium' - a large divergence that suggests the 9.6 may be an inflated or auto-generated score and the vendor views real-world impact as moderate. No EPSS score, KEV listing, or POC were supplied, so there is no public exploit identified at the time of analysis and no evidence of active exploitation. The CVSS vector requires user interaction (UI:R) and relies on social engineering per the description, which materially lowers practical exploitability versus a zero-click bug. A further inconsistency: the description specifies 'Chrome on iOS,' but Chrome for iOS is required by Apple to use the WebKit engine rather than Chromium's Blink/V8 sandbox, making a 'code execution outside the sandbox' Chromium-engine bug on iOS technically questionable - this should be verified with the vendor, as the description, CPE (generic google:chrome), and the desktop-labeled reference URL do not cleanly agree. Net: treat as a patch-soon item (vendor fix available) rather than an emergency, because exploitation requires victim interaction, no exploitation signal exists, and the vendor itself rates it Medium.

A remote attacker crafts a malicious HTML page and uses social engineering (phishing link, malvertising) to lure a victim into opening it in Chrome on their mobile device. The page triggers an input-validation flaw (CWE-20) that the advisory describes as potentially leading to arbitrary code execution outside the browser sandbox. No public proof-of-concept or exploit code was provided in the source data, and success depends on the victim actively visiting the attacker-controlled page.