CVE-2026-106256: Information leak in Google Chrome

This vulnerability involves an information leak in the password management component of Google Chrome on Android devices before version 155.0.8059.39. An attacker leveraging social engineering techniques could cause a user to visit a maliciously crafted HTML page, resulting in unauthorized disclosure of sensitive password data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor has published a security update to fix this issue.

Successful exploitation allows a remote attacker to obtain sensitive password information from the affected Chrome browser on Android, potentially compromising user credentials and leading to further account compromise. The vulnerability requires user interaction (social engineering) and does not require privileges or prior access.

Google has released an official fix in Chrome version 155.0.8059.39. Users and administrators should update affected Chrome installations on Android to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.