Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML… (CVE-2026-106365)

CVE-2026-106365 describes a missing authorization flaw in the Animation feature of Google Chrome before version 155.0.8059.39. This flaw enables a remote attacker to bypass the web origin policy by crafting a malicious HTML page, potentially allowing unauthorized integrity-impacting actions. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.5, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

The vulnerability allows remote attackers to bypass the web origin policy, which can lead to unauthorized modification or manipulation of web content (integrity impact). There is no impact on confidentiality or availability. Exploitation requires user interaction but no privileges or authentication.

A fix is available in Google Chrome version 155.0.8059.39 and later. Users and administrators should update to this version or newer to remediate the vulnerability. Since this is not a cloud service, patching the client software is required. No known exploits are reported in the wild at this time.