Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web… (CVE-2026-106362)

CVE-2026-106362 describes a missing authorization issue in the DevTools component of Google Chrome before version 155.0.8059.39. This flaw enables a remote attacker, using social engineering tactics and a specially crafted Chrome extension, to bypass the web origin policy. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

The vulnerability allows an attacker to bypass the web origin policy, potentially leading to unauthorized modification of data or actions within the browser context. However, there is no confidentiality or availability impact reported. The attack requires user interaction (social engineering) and does not require prior privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to 155.0.8059.39, updating to version 155.0.8059.39 or later is likely recommended once confirmed by the vendor. Until then, users should exercise caution with Chrome extensions and avoid installing untrusted extensions.