CVE-2026-106403: Incorrect authorization in Google Chrome

CVE-2026-106403 is an authorization flaw in Google Chrome's Accessibility feature affecting versions before 155.0.8059.39. A remote attacker with control over the renderer process can exploit this vulnerability to bypass site isolation protections via a specially crafted HTML page. Site isolation is a security feature designed to prevent cross-site data leaks by isolating different sites into separate processes. The vulnerability has been assigned a medium severity level by Chromium security. The issue is addressed in Chrome version 155.0.8059.39 as per the vendor advisory.

Successful exploitation allows an attacker who has already compromised the renderer process to bypass site isolation, potentially enabling access to data from other sites that should be isolated. This could weaken Chrome's security model and increase the risk of cross-site data leakage. However, exploitation requires prior compromise of the renderer process.

Google has released an official fix in Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.