CVE-2026-106361: Incorrect provision of specified functionality in Google Chrome

This vulnerability in Google Chrome on iOS versions before 155.0.8059.39 allows a remote attacker to bypass the web origin policy by leveraging social engineering techniques combined with crafted network traffic. The flaw is due to incorrect implementation of specified functionality related to web origin enforcement. The issue was addressed in version 155.0.8059.39. No CVSS score is provided, but the Chromium security team rates it as medium severity.

The impact is a bypass of the web origin policy, which is a fundamental security control in browsers designed to isolate web content from different origins. Exploitation could allow an attacker to access or manipulate data from other origins without proper authorization, potentially leading to information disclosure or unauthorized actions within the browser context. However, exploitation requires social engineering and crafted network traffic.

Users should update Google Chrome on iOS to version 155.0.8059.39 or later, where this vulnerability has been fixed. No additional mitigation steps are indicated by the vendor advisory. Patch status is confirmed by the vendor advisory linked.