{"id":"CVE-2026-106194","published":"2026-10-06T19:17:45.557","lastModified":"2026-10-08T13:03:54.067","description":"Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvssScore":8.3,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":["google"],"products":["chrome"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/498739277","tags":["Permissions Required"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Chrome's WebAppInstalls feature had missing authorization checks that allowed attackers with compromised renderer processes to execute arbitrary code outside the sandbox via crafted HTML pages. This represents a privilege escalation vulnerability where attackers can bypass Chrome's security boundaries.","exploitability":"Exploitation requires compromising the renderer process first, then using social engineering to convince a user to visit a malicious page, making it moderately difficult but possible with a successful phishing campaign.","blast_radius":"The vulnerability affects all Chrome users on versions prior to 155.0.8059.39, potentially allowing attackers to execute arbitrary code on user systems with full browser privileges, including access to local files and network resources.","remediation":"Upgrade to Chrome 155.0.8059.39 or later immediately","detection":"No reliable host or network indicator is derivable from the published description.","tags":["browser","privilege-escalation","sandbox-bypass"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:56:21.986Z"}}