CVE-2026-106194: Missing authorization in Google Chrome

This vulnerability involves missing authorization checks in the WebAppInstalls feature of Google Chrome versions before 155.0.8059.39. An attacker who has already compromised the renderer process and can trick a user through social engineering may execute arbitrary code outside the sandbox environment by delivering a specially crafted HTML page. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow remote code execution outside the sandbox, leading to full compromise of the affected system. The attacker must have already compromised the renderer process and rely on social engineering to trigger the exploit. This elevates the risk of code execution beyond the sandbox protections normally enforced by Chrome.

A stable channel update for Google Chrome has been released addressing this vulnerability. Users should update to version 155.0.8059.39 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.