CVE-2026-106363: Missing authorization in Google Chrome

CVE-2026-106363 is a vulnerability in Google Chrome's FullScreen functionality before version 155.0.8059.39. It involves missing authorization checks that could be exploited by a remote attacker who has already compromised the renderer process. By leveraging social engineering and a crafted HTML page, the attacker can bypass system access restrictions. This vulnerability was publicly disclosed and patched in the stable channel update referenced by Google.

The vulnerability allows an attacker with control over the renderer process to bypass system access restrictions, potentially enabling unauthorized actions or access within the context of the browser's FullScreen mode. The impact is limited to scenarios where the renderer process is already compromised and social engineering is used to trigger the exploit.

A fix is available in Google Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory for details: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html