{"id":"CVE-2026-106191","published":"2026-10-06T19:17:45.207","lastModified":"2026-10-08T13:06:36.927","description":"Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","cvssScore":8.3,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":["google"],"products":["chrome"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/502282293","tags":["Permissions Required"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A missing authorization check in Google Chrome's Actor component allowed attackers who already compromised the renderer process to execute arbitrary code outside the sandbox, potentially leading to full system compromise. This vulnerability acts as a privilege escalation vector from renderer to system-level access.","exploitability":"Exploitation requires an attacker to first compromise the renderer process, then craft a malicious HTML page that triggers the authorization bypass, making it moderately difficult but achievable with a multi-stage attack approach.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the user's system with full privileges, potentially leading to complete system compromise, data theft, or persistent backdoor installation.","remediation":"Upgrade to Google Chrome version 155.0.8059.39 or later to remediate this authorization bypass vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","sandbox-bypass","browser-vulnerability"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:56:27.521Z"}}