Incorrect authorization in Scheduling in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted… (CVE-2026-106297)

CVE-2026-106297 describes an incorrect authorization vulnerability in the scheduling mechanism of Google Chrome versions before 155.0.8059.39. This flaw enables a remote attacker to bypass the web origin policy by delivering a specially crafted HTML page. The web origin policy is a critical security control that isolates web content from different origins. The vulnerability does not impact confidentiality or availability but can cause limited integrity loss. The CVSS vector indicates the attack requires no privileges and user interaction, with network attack vector and low attack complexity.

The vulnerability allows a remote attacker to bypass the web origin policy, potentially enabling unauthorized actions within the browser context. However, the impact is limited to integrity and does not affect confidentiality or availability. The Chromium security team rates this issue as low severity, and the CVSS score of 4.3 reflects a medium severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Users should monitor official Google Chrome security advisories for updates and apply the update to version 155.0.8059.39 or later once available.