CVE-2026-106198: Missing authorization in Google Chrome

CVE-2026-106198 describes a missing authorization flaw in the FileSystem feature of Google Chrome versions before 155.0.8059.39. An attacker with control over the renderer process can exploit this vulnerability to bypass the web origin policy, potentially accessing or manipulating data across origins via a specially crafted HTML page. This vulnerability is limited to scenarios where the renderer process is already compromised.

The vulnerability allows bypassing the web origin policy, which is a fundamental security control in browsers to isolate content from different origins. Exploitation could lead to unauthorized access or manipulation of data across web origins. However, exploitation requires prior compromise of the renderer process, limiting the attack scope. The severity is rated medium by Chromium security.

Google has released an official fix in Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.