Google Chrome CVE-2026-106422

Exploitation requires the victim to actively open an attacker-crafted HTML page in a vulnerable Chrome build prior to 155.0.8059.39 (UI:R in the CVSS vector), so this is not a drive-by that works without any user action beyond navigation. No authentication is required (PR:N) and no special browser configuration or non-default feature is named in the description - the flaw is in the browser's API authorization logic itself, affecting default installations. The primary limiting factors are the mandatory user navigation to the malicious page and the limited impact (integrity-only per the official vector, with no confidentiality or availability loss), which together cap realistic severity despite the network attack vector.

This is a genuinely low-priority issue across every available signal, and the signals are consistent rather than conflicting. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (victim must open a crafted page) and yields only a limited integrity impact with no confidentiality or availability loss - Chromium itself rated the security severity 'Low'. EPSS reinforces this: 0.19% probability at the 8th percentile indicates very low expected exploitation activity. The vulnerability is NOT in CISA KEV, and no public exploit or POC is referenced in the provided data, so there is no evidence of active exploitation or weaponization. The only upward pressure on risk comes from product ubiquity (Chrome is deployed almost everywhere), which means a weaponized same-origin-policy bypass could have broad reach - but the limited technical impact and mandatory user interaction keep real-world risk modest. Note one point of interpretive tension worth verifying: the description characterizes the flaw as a 'web origin policy' bypass, which in practice often enables cross-origin data READS (a confidentiality impact), yet the official vector sets C:N/I:L; defenders relying on impact categorization should confirm with Google whether cross-origin reads are possible.

An attacker hosts or compromises a web page containing crafted HTML and lures a victim running a vulnerable Chrome build (prior to 155.0.8059.39) into visiting it. When the page loads, it abuses the incorrect authorization in the browser API to bypass the web origin policy and interact with content from another origin that should have been isolated. No public exploit code is identified at time of analysis, and successful exploitation depends on the victim actively opening the attacker-controlled page (UI:R).