Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and… (CVE-2026-106363)

CVE-2026-106363 describes a missing authorization flaw in the FullScreen functionality of Google Chrome versions before 155.0.8059.39. An attacker who has already compromised the renderer process can exploit this vulnerability by tricking the user into interacting with a maliciously crafted HTML page, thereby bypassing system access restrictions. The vulnerability has a CVSS 3.1 base score of 8.3, indicating high severity with network attack vector, high attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability with scope changed.

Successful exploitation allows an attacker with control over the renderer process to bypass system access restrictions, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The attack requires user interaction and prior compromise of the renderer process but can result in significant security impact.

The vulnerability is fixed in Google Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the issue. No other mitigation or temporary workaround is indicated in the provided data.