CVE-2026-106355: Missing authorization in Google Chrome

CVE-2026-106355 describes a missing authorization flaw in the Media component of Google Chrome on Windows platforms before version 155.0.8059.39. This flaw permits a remote attacker, who has already compromised the renderer process, to extract sensitive information by leveraging a specially crafted HTML page. The vulnerability is rated with a CVSS 3.1 base score of 5.3, indicating medium severity, with network attack vector, high attack complexity, no privileges required, user interaction required, and impact limited to confidentiality.

An attacker who has compromised the renderer process can exploit this vulnerability to access sensitive information from the affected Chrome browser on Windows. The impact is limited to confidentiality loss; integrity and availability are not affected. The vulnerability requires user interaction and has high attack complexity, reducing the likelihood of widespread exploitation.

A fix is available in Google Chrome version 155.0.8059.39. Users and administrators should update affected Chrome installations on Windows to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html for details and confirmation of the patch.