CVE-2026-106230: Incorrect reference resolution in Google Chrome

This vulnerability in Google Chrome on Android (versions before 155.0.8059.39) is due to incorrect reference resolution in the Offline component. Exploitation requires that the attacker has already compromised the renderer process. By leveraging a specially crafted HTML page, the attacker can obtain sensitive information. The CVSS 3.1 base score is 5.3, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact. Google has published a stable channel update to fix this issue.

An attacker who has compromised the renderer process can exploit this vulnerability to obtain sensitive information from the affected Chrome browser on Android. The confidentiality impact is high, but integrity and availability are not affected. The attack requires user interaction and has high complexity, limiting the ease of exploitation.

Google has released an official stable channel update for Chrome that addresses this vulnerability. Users should update Chrome on Android to version 155.0.8059.39 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.