CVE-2026-106425: Missing authorization in Google Chrome

CVE-2026-106425 is a missing authorization vulnerability in the BrowserTag feature of Google Chrome versions before 155.0.8059.39. This flaw permits a remote attacker, who has already compromised the renderer process and employed social engineering, to bypass Chrome's site isolation protections by using a specially crafted HTML page. This vulnerability was rated medium severity by Chromium security. Google has released a stable channel update to fix this issue.

The vulnerability allows an attacker with control over the renderer process and the ability to trick a user via social engineering to bypass site isolation, potentially weakening Chrome's security boundaries between sites. This could lead to unauthorized access to data or functionality normally isolated by site isolation mechanisms. However, exploitation requires prior compromise of the renderer process and social engineering, limiting the attack scope.

Google has released an official stable channel update for Chrome that fixes this vulnerability in version 155.0.8059.39. Users and administrators should update to this version or later to remediate the issue. No additional mitigation actions are indicated by the vendor advisory.