CVE-2026-106212: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome's Autofill component prior to version 155.0.8059.39 allows a remote attacker to bypass authorization controls via social engineering techniques involving a crafted HTML page. Exploitation can lead to unauthorized disclosure of sensitive user information. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor has published a stable channel update to fix this vulnerability.

Successful exploitation allows remote attackers to obtain sensitive information from the Autofill feature without proper authorization. This compromises user privacy and security, potentially exposing confidential data. The vulnerability affects confidentiality, integrity, and availability as per the CVSS vector.

Google has released an official fix in Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.