CVE-2026-106369: Missing authorization in Google Chrome

CVE-2026-106369 is a missing authorization vulnerability in the Translate component of Google Chrome before version 155.0.8059.39. An attacker who has already compromised the renderer process can exploit this flaw by crafting a malicious HTML page to bypass Chrome's site isolation security feature. Site isolation is a critical defense mechanism designed to prevent cross-site data leaks by separating different sites into different processes. The vulnerability was publicly disclosed and fixed in Chrome 155.0.8059.39.

Successful exploitation allows an attacker with renderer process control to bypass site isolation protections, potentially enabling access to data from other sites or processes that should be isolated. This undermines a key security boundary in Chrome, increasing the risk of data leakage or further compromise within the browser environment.

Users should update Google Chrome to version 155.0.8059.39 or later, where this vulnerability has been fixed. No additional mitigation steps are required as the vendor has provided an official fix.