Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a… (CVE-2026-106381)

CVE-2026-106381 describes an incorrect authorization vulnerability in the password management feature of Google Chrome on iOS before version 155.0.8059.39. This flaw allows a remote attacker to bypass the web origin policy by leveraging a crafted HTML page. The web origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. Bypassing this policy can lead to unauthorized actions or information disclosure within the browser context. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

The vulnerability allows a remote attacker to bypass the web origin policy in Google Chrome on iOS, potentially enabling unauthorized modification of data or actions within the browser's password management context. There is no indication of confidentiality or availability impact. The integrity impact is high, meaning attackers could alter data or state inappropriately. No known exploits are reported in the wild at this time.

The vulnerability affects versions of Google Chrome on iOS prior to 155.0.8059.39. Users and administrators should update to version 155.0.8059.39 or later once available to remediate this issue. Patch status is not explicitly confirmed in the provided data; therefore, check the official Google Chrome security advisories for the latest remediation guidance. No alternative mitigations are specified.