CVE-2026-106396: Improper input validation in Google Chrome

This vulnerability is due to improper input validation in the Omnibox feature of Google Chrome on Android devices before version 155.0.8059.39. An attacker can exploit this flaw by crafting a malicious HTML page that, when combined with social engineering, bypasses the web origin policy. The web origin policy is a critical security mechanism that prevents malicious sites from accessing or manipulating content from other origins. The vulnerability was assigned a high severity by Chromium security. The vendor has released an update to fix this issue in Chrome version 155.0.8059.39.

Successful exploitation allows a remote attacker to bypass the web origin policy, potentially misleading users about the true origin of web content. This can lead to security risks such as phishing or unauthorized access to sensitive information within the browser context. However, exploitation requires social engineering to convince the user to visit a crafted HTML page.

Users should update Google Chrome on Android to version 155.0.8059.39 or later, where this vulnerability is fixed. No additional mitigation steps are indicated by the vendor advisory. Patch status is confirmed by the vendor's stable channel update announcement.