CVE-2026-110160: Missing authorization in Google Chrome

CVE-2026-110160 describes a missing authorization flaw in the ReadingMode component of Google Chrome versions before 155.0.8059.79. An attacker who has already compromised the renderer process and employs social engineering techniques can exploit this vulnerability to bypass Chrome's site isolation protections by delivering a specially crafted HTML page. This could undermine the browser's security model that isolates sites to prevent data leakage between them.

The vulnerability allows bypassing of site isolation, which is a key security feature designed to prevent cross-site data leaks. Exploitation requires prior compromise of the renderer process and social engineering, limiting the attack vector but still posing a significant risk to browser security and user data confidentiality.

Google has released an official fix in Chrome version 155.0.8059.79. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.