CVE-2026-106253: Incorrect authorization in Google Chrome

CVE-2026-106253 is an authorization flaw in Google Chrome's Extensions component affecting versions before 155.0.8059.39. The vulnerability enables a remote attacker to bypass authorization controls and obtain cross-origin data by using a crafted Chrome extension. This could lead to unauthorized access to data from different origins within the browser context. The issue is classified with medium severity by the Chromium security team. The vendor has released an official fix in Chrome version 155.0.8059.39.

Exploitation of this vulnerability allows a remote attacker to bypass authorization checks in Chrome Extensions and access cross-origin data, potentially exposing sensitive user information from different web origins. The impact is limited to the browser environment and depends on the attacker's ability to distribute a malicious extension.

Users should update Google Chrome to version 155.0.8059.39 or later, where this vulnerability has been fixed. Applying this official update fully mitigates the issue.