Google Chrome CVE-2026-106424

Exploitation requires the attacker to have ALREADY compromised Chrome's renderer process (a prior-stage foothold), after which a crafted Chrome extension abuses the Audio component to read memory outside the sandbox. Key limiting factors: the renderer must be pre-compromised via a separate exploit, high attack complexity (AC:H) implies non-trivial preconditions such as specific memory state, and the impact is limited to confidentiality (an information leak, no code execution or data modification). This is a sandbox-escape/info-disclosure primitive intended to be chained, not a self-contained remote attack, which substantially limits real-world exploitability despite the network attack vector. All versions of Google Chrome prior to 155.0.8059.39 on affected desktop platforms are vulnerable.

This is a genuine but lower-tier priority - a Medium-severity sandbox information leak, not a standalone remote compromise. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) scores 4.0, driven down by high attack complexity (AC:H) and only low confidentiality impact (C:L) with no integrity or availability impact. EPSS is very low at 0.16% (5th percentile), and the vulnerability is NOT listed in CISA KEV and has no public exploit identified, so all exploitation signals point to low near-term risk. CRITICAL CAVEAT: the CVSS vector marks PR:N (no privileges), but the description explicitly states the attacker must have 'compromised the renderer process' first - these conflict. In practice this is a second-stage sandbox-boundary read used to chain with a prior renderer RCE, not a directly exploitable network bug; the PR:N/AV:N scoring reflects Chrome's malicious-web-page threat model rather than a literal unauthenticated one-shot. Verify intended attacker model with the Chrome advisory. Overall: patch in the normal Chrome update cadence; this does not warrant emergency response on its own.

An attacker first achieves code execution in Chrome's sandboxed renderer process (via a separate, chained vulnerability), then delivers a crafted Chrome extension that abuses the Audio component to read memory lying outside the sandbox boundary, disclosing sensitive data from a more privileged process. No public exploit code is identified at time of analysis, and the high attack complexity means successful exploitation requires precise conditions and a pre-existing renderer foothold.