CVE-2026-106366: Incomplete cleanup in Google Chrome

This vulnerability arises from incomplete cleanup in the CustomTabs feature of Google Chrome on Android, allowing a remote attacker to bypass the web origin policy through a crafted HTML page. The web origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. Bypassing this policy can lead to unauthorized access to sensitive information or actions across origins. The issue affects Chrome versions prior to 155.0.8059.39 on Android. Google has released a stable channel update to fix this vulnerability.

Successful exploitation allows a remote attacker to bypass the web origin policy, potentially enabling unauthorized access to web resources or data that should be isolated by origin boundaries. This can compromise user data confidentiality and integrity within the affected Chrome browser on Android devices.

A fix is available in Google Chrome version 155.0.8059.39 and later. Users and administrators should update Chrome on Android to version 155.0.8059.39 or newer to mitigate this vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html for detailed update instructions.