Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass… (CVE-2026-106331)

CVE-2026-106331 describes an improper input validation vulnerability in the Extensions component of Google Chrome versions before 155.0.8059.39. An attacker can exploit this flaw by leveraging social engineering techniques to bypass the web origin policy, thereby gaining access to privileged pages through a specially crafted Chrome extension. The flaw is classified under CWE-20 (Improper Input Validation) and has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No known exploits are reported in the wild, and the vulnerability requires user interaction (UI:R).

The vulnerability allows a remote attacker to bypass the web origin policy, potentially leading to unauthorized access to privileged pages within the browser context. This could result in integrity impacts but does not affect confidentiality or availability. The attack requires user interaction and social engineering to succeed.

A fix is available in Google Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated.