CVE-2026-106262: Incomplete cleanup in Google Chrome

The vulnerability CVE-2026-106262 in Google Chrome arises from incomplete cleanup in the GetUserMedia API implementation. An attacker who has already compromised the renderer process can exploit this flaw by crafting a malicious HTML page that spoofs UI elements, potentially misleading users. This issue was assigned a medium severity by Chromium security. The vulnerability affects Chrome versions prior to 155.0.8059.39, which has been patched in the stable channel update.

If exploited, this vulnerability could allow an attacker with renderer process access to deceive users by spoofing UI elements, potentially leading to further social engineering attacks. However, exploitation requires prior compromise of the renderer process, limiting the scope of direct impact. The severity is rated medium by the vendor.

An official fix is available in Google Chrome version 155.0.8059.39 and later. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html for update details.