CVE-2026-106286: Confused deputy in Google Chrome

CVE-2026-106286 is a confused deputy vulnerability in the Omnibox of Google Chrome that enables a remote attacker to bypass the web origin policy by sending crafted network traffic. This flaw affects Chrome versions prior to 155.0.8059.39. The web origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. The vulnerability was publicly disclosed with a medium severity rating by Chromium security. The vendor advisory confirms that the issue is fixed in Chrome version 155.0.8059.39.

Successful exploitation allows a remote attacker to bypass the web origin policy, potentially enabling unauthorized access to web resources that should be restricted by origin. This could lead to information disclosure or other security issues related to cross-origin interactions. The severity is rated medium, indicating a moderate impact on confidentiality or integrity.

Users and administrators should update Google Chrome to version 155.0.8059.39 or later to remediate this vulnerability. The vendor advisory confirms that this version contains the official fix. No additional mitigation steps are required once the update is applied.