CVE-2026-106226: Improper input validation in Google Chrome

CVE-2026-106226 is a vulnerability in Google Chrome's Compositing component where improper input validation enables a remote attacker with control over the renderer process to spoof the browser's address bar by using a specially crafted HTML page. This flaw affects versions of Chrome prior to 155.0.8059.39. The vulnerability was assigned a medium severity level by Chromium security. Google has issued a stable channel update to fix this issue as referenced in their official advisory.

An attacker who has already compromised the renderer process can exploit this vulnerability to spoof the address bar, potentially misleading users about the actual URL they are visiting. This could facilitate phishing or other social engineering attacks by making malicious pages appear legitimate. However, exploitation requires prior compromise of the renderer process, limiting the scope of direct remote exploitation.

Google has released a stable channel update for Chrome that addresses this vulnerability. Users and administrators should update their Chrome installations to version 155.0.8059.39 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.