Google Chrome CVE-2026-110918

Exploitation requires the victim to open an attacker-crafted HTML page in a vulnerable Chrome build prior to 155.0.8059.84 (UI:R, user interaction) - it is not wormable or drive-by against a passive target without a page load. No authentication is required (PR:N, unauthenticated remote attacker). The flaw resides in Chrome's Core component and affects default configurations, so no special feature or non-default setting is needed; the primary limiting factor is the mandatory user interaction and the read-only confidentiality impact (no code execution, data modification, or availability loss is claimed).

This is a genuine but lower-tier priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) scores 4.3 (Medium) because, despite a network attack vector and no privileges required, the impact is limited to partial confidentiality (memory read only - C:L, I:N, A:N) and exploitation requires user interaction (UI:R), i.e. the victim must open a crafted HTML page. Note a divergence in severity signals: Chromium labels this 'High' severity internally, whereas the CVSS base score is only Medium - the internal rating reflects memory-corruption class and exploit potential, while CVSS reflects the confirmed partial read-only impact. Exploitation signals are consistently low: SSVC reports Exploitation=none, Automatable=no, Technical Impact=partial; there is no CISA KEV listing and no public exploit identified at time of analysis. The absence of EPSS data in the input means exploitation probability cannot be quantified here. Net: a vendor-confirmed, patched information-disclosure flaw in an ubiquitous product - worth prompt patching due to Chrome's deployment footprint, but not an emergency given read-only impact, required user interaction, and no evidence of exploitation.

An attacker hosts or injects a maliciously crafted HTML page and lures a victim into visiting it (e.g. via phishing link or malvertising). When the page is rendered by a vulnerable Chrome build (prior to 155.0.8059.84), the memory-corruption flaw in the Core component is triggered, allowing the attacker to read out-of-bounds process memory, potentially leaking sensitive in-memory data. No public exploit identified at time of analysis.