CVE-2026-106271: Missing authorization in Google Chrome

CVE-2026-106271 describes a missing authorization flaw in the Workers component of Google Chrome before version 155.0.8059.39. An attacker who has already compromised the renderer process can exploit this vulnerability by crafting a malicious PDF file to bypass Chrome's site isolation security feature. This bypass could potentially allow the attacker to access data or processes that should be isolated between sites. The vulnerability is classified as medium severity by Chromium security.

The vulnerability enables an attacker with access to the renderer process to bypass site isolation protections, which are designed to prevent cross-site data leaks and improve security boundaries within the browser. This could lead to unauthorized access to sensitive information across different sites within the browser context.

Google has released an official fix in Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html for update details and confirmation of the patch.