CVE-2026-106312: Missing authorization in Google Chrome

CVE-2026-106312 is a vulnerability in Google Chrome's SignIn functionality affecting versions before 155.0.8059.39. The flaw involves missing authorization checks that could be exploited by a remote attacker using social engineering techniques to deliver a malicious Chrome extension. Successful exploitation could lead to unauthorized disclosure of sensitive information. The Chromium security team has rated this vulnerability as low severity internally, but the CVSS score assigned is 6.5, indicating a medium impact on confidentiality. There is no indication of active exploitation in the wild.

The vulnerability allows an attacker to obtain sensitive information from the affected Chrome browser by leveraging social engineering to convince users to install a malicious extension. The impact is limited to confidentiality loss without integrity or availability impact. No evidence of exploitation in the wild has been reported.

A fix is available in Google Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html for detailed patch information and update instructions.