Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to… (CVE-2026-106267)

CVE-2026-106267 describes a missing authorization flaw in the Network module of Google Chrome versions before 155.0.8059.39. This flaw enables a remote attacker, who already controls the renderer process, to bypass site isolation protections by leveraging a specially crafted HTML page. The vulnerability is classified under CWE-862 (Missing Authorization) and has a CVSS v3.1 base score of 6.5, indicating a medium severity level. No known exploits in the wild have been reported.

An attacker with control over the renderer process can bypass site isolation, potentially allowing them to interfere with or access data from other sites' processes that should be isolated. This could lead to unauthorized information disclosure or manipulation within the browser context. However, the vulnerability does not impact confidentiality directly (CVSS C:N), but it does impact integrity (I:H) without affecting availability.

A fix is available in Google Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. Since this is a client-side software vulnerability, applying the official update is the recommended mitigation.