Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering… (CVE-2026-106396)

CVE-2026-106396 describes an improper input validation vulnerability in the Omnibox feature of Google Chrome on Android platforms before version 155.0.8059.39. An attacker could exploit this flaw by crafting a malicious HTML page and leveraging social engineering techniques to bypass the web origin policy, potentially causing limited information disclosure or modification. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity, with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, and low confidentiality and integrity impacts.

The vulnerability allows a remote attacker to bypass the web origin policy, which may lead to limited unauthorized access to information or modification of data within the browser context. There is no indication of availability impact. The overall impact is rated medium based on the CVSS score and described effects.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should update Google Chrome on Android to version 155.0.8059.39 or later once available to address this issue.