CVE-2026-106277: Information leak in Google Chrome

CVE-2026-106277 is an information disclosure vulnerability in Google Chrome's Animation feature affecting versions before 155.0.8059.39. A remote attacker can exploit this flaw by delivering a specially crafted HTML page that causes cross-origin data leakage. The vulnerability does not require privileges or user interaction beyond visiting the malicious page. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction required. The vendor has published an advisory indicating a stable channel update addressing this issue.

Successful exploitation allows an attacker to leak cross-origin data, potentially exposing sensitive information from other origins accessible in the browser context. There is no indication of integrity or availability impact. The vulnerability requires user interaction (visiting a malicious page) but no privileges.

Google has released a stable channel update for Chrome that fixes this vulnerability in version 155.0.8059.39. Users and administrators should update to this version or later to remediate the issue. No additional mitigations are indicated by the vendor advisory.