CVE-2026-106267: Missing authorization in Google Chrome

CVE-2026-106267 is a vulnerability in Google Chrome's Network component where missing authorization allows a remote attacker, with control over the renderer process, to bypass site isolation protections via a crafted HTML page. This flaw affects Chrome versions prior to 155.0.8059.39. Site isolation is a security feature designed to separate different websites into different processes to prevent data leaks and cross-site attacks. The vulnerability was publicly disclosed and patched by Google in the stable channel update referenced in the vendor advisory.

An attacker who has already compromised the renderer process can exploit this vulnerability to bypass site isolation, potentially allowing access to data or processes that should be isolated. This could weaken Chrome's security boundaries between sites, increasing the risk of data leakage or unauthorized access within the browser context. The severity is rated medium by Chromium security.

A fix is available in Google Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html for detailed update instructions.