CVE-2026-106241: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome on Android versions before 155.0.8059.39 arises from incorrect authorization in the Search component. An attacker can exploit this flaw by tricking a user into visiting a maliciously crafted HTML page, which may lead to arbitrary code execution outside the browser sandbox. The issue is rated critical with a CVSS 3.1 base score of 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope change, and high impact on confidentiality, integrity, and availability. The vendor has published a stable channel update addressing this issue.

Successful exploitation allows remote attackers to execute arbitrary code outside the sandbox on affected Android devices running vulnerable Chrome versions. This compromises the confidentiality, integrity, and availability of the affected system. The attack requires user interaction via social engineering but does not require prior privileges.

A fix is available in Google Chrome version 155.0.8059.39 and later. Users and administrators should update affected Chrome installations on Android to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory for details: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html