CVE-2026-106405: Race condition in Google Chrome

CVE-2026-106405 is a race condition vulnerability in the CustomTabs feature of Google Chrome on Android platforms before version 155.0.8059.39. This race condition can be exploited by a local attacker through a co-installed application to bypass the web origin policy, potentially allowing unauthorized access to web content restricted by origin. The vulnerability is classified with medium severity by Chromium security. The vendor advisory URL is provided but does not explicitly confirm patch availability in the input data.

The vulnerability allows a local attacker with a co-installed app to bypass the web origin policy, which is a fundamental security control in browsers that restricts how documents or scripts loaded from one origin can interact with resources from another origin. This could lead to unauthorized access or manipulation of web content within the affected Chrome environment on Android devices.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html for current remediation guidance. Users should update Google Chrome on Android to version 155.0.8059.39 or later once the fix is confirmed available.