Google Chrome CVE-2026-106416

Exploitation requires the victim to install a specifically crafted malicious Chrome extension, delivered through social engineering - this is not exploitable against a default, clean Chrome install without that user action. The limiting factors are therefore substantial: mandatory user interaction (UI:R), the need to convince the user to add an untrusted extension (bypassing Chrome Web Store vetting or using sideloading/developer mode), and a client version prior to 155.0.8059.39. There is no server-side or drive-by path; the attack surface is confined to the extensions subsystem and depends on the user actively adding attacker-controlled code.

This is a genuinely LOW-to-MODERATE real-world priority despite Chrome's ubiquity. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, base 5.4, vendor-rated Medium) describes a network-reachable but user-interaction-dependent issue with only Low confidentiality and Low availability impact and NO integrity impact (I:N) - inconsistent with the 'RCE' tag applied in the input, which overstates the flaw (this is UI spoofing, not arbitrary code execution on the host). Exploitation requires the victim to be socially engineered into installing a crafted malicious extension, which is a significant practical barrier. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis. The signals are internally consistent (low severity, high interaction requirement, no exploitation evidence) and point to a low-urgency patch-on-normal-cycle item rather than an emergency, notwithstanding the enormous install base of Chrome.

An attacker publishes or distributes a crafted Chrome extension and uses social engineering (phishing, fake tooling, deceptive listing) to convince a user to install it. Once installed, the extension abuses the code-injection weakness to spoof browser UI elements, potentially tricking the victim into trusting fraudulent prompts or disclosing information. No public exploit code is identified at time of analysis, and the attack cannot proceed without the user installing the extension (UI:R).