Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and… (CVE-2026-106425)

CVE-2026-106425 describes a missing authorization flaw in the BrowserTag feature of Google Chrome before version 155.0.8059.39. An attacker who has already compromised the renderer process can exploit this vulnerability by leveraging social engineering techniques with a specially crafted HTML page to bypass Chrome's site isolation security feature. The vulnerability is rated medium severity with a CVSS 3.1 score of 4.2, reflecting low confidentiality and integrity impact, no availability impact, and requiring user interaction and high attack complexity.

The vulnerability allows an attacker who has compromised the renderer process to bypass site isolation protections, potentially leading to limited unauthorized access to data or functionality within the browser context. The impact is limited to confidentiality and integrity with no availability impact. Exploitation requires user interaction and is considered complex.

No explicit patch or remediation details are provided in the available data. Since the vulnerability affects versions prior to 155.0.8059.39, updating Google Chrome to version 155.0.8059.39 or later is recommended once the vendor releases the fix. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.