CVE-2026-106364: Incorrect authorization in Google Chrome

CVE-2026-106364 describes an incorrect authorization vulnerability in the Omnibox component of Google Chrome versions before 155.0.8059.39. This flaw permits a remote attacker, who has already compromised the renderer process, to access sensitive information by leveraging a specially crafted HTML page. The vulnerability is rated as high severity by Chromium security but has a medium CVSS score of 5.3, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact.

An attacker with control over the renderer process can exploit this vulnerability to obtain sensitive information from the browser. This could lead to information disclosure but does not affect integrity or availability. The attack requires user interaction and has a high attack complexity, limiting the ease of exploitation.

Google has released an official fix in Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated in the vendor advisory.