CVE-2026-106205: Missing authorization in Google Chrome

CVE-2026-106205 is a vulnerability in Google Chrome on Android where missing authorization in the Passwords feature allows a remote attacker, who has already compromised the renderer process, to bypass site isolation protections by leveraging a specially crafted HTML page. This flaw affects versions of Chrome on Android prior to 155.0.8059.39. The vulnerability is rated medium severity by Chromium security. The vendor has published an advisory indicating a stable channel update that addresses this issue.

An attacker who has compromised the renderer process can bypass site isolation protections, potentially enabling access to data or actions normally restricted by site isolation. This could weaken Chrome's security model on affected Android versions. However, exploitation requires prior compromise of the renderer process, limiting the attack scope.

A fix is available in Google Chrome version 155.0.8059.39 and later. Users and administrators should update Chrome on Android to version 155.0.8059.39 or newer to remediate this vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html for more details.