Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (CVE-2026-106286)

CVE-2026-106286 describes a confused deputy vulnerability in the Omnibox feature of Google Chrome versions prior to 155.0.8059.39. This flaw enables a remote attacker to bypass the web origin policy by sending specially crafted network traffic. The web origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. Bypassing this policy can lead to unauthorized actions or data manipulation within the browser context. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.5, indicating a network attack vector with low attack complexity, no privileges required, but requiring user interaction, and impacting integrity without affecting confidentiality or availability.

Successful exploitation allows an attacker to bypass the web origin policy in affected Chrome versions, potentially enabling unauthorized modification of web content or actions that violate the intended origin restrictions. This impacts the integrity of web interactions but does not affect confidentiality or availability according to the CVSS vector.

A fix is available in Google Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the official browser update. No additional mitigation steps are indicated.