{"id":"CVE-2026-106198","published":"2026-10-06T19:17:46.020","lastModified":"2026-10-08T16:17:02.097","description":"Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","cvssScore":8.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","cwes":["CWE-862"],"vendors":["google"],"products":["chrome"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/510773353","tags":["Permissions Required"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Chrome's FileSystem API lacked proper authorization checks, allowing a compromised renderer process to bypass web origin policies and access files from other origins. This creates a path for attackers to escalate privileges and potentially exfiltrate sensitive data.","exploitability":"Exploitation requires compromising the renderer process first, which is moderately difficult but achievable through a previous vulnerability, then crafting a malicious HTML page that triggers the authorization bypass.","blast_radius":"The flaw affects all Chrome users who visit malicious websites, with potential for cross-origin data theft and privilege escalation across different web applications.","remediation":"Upgrade to Chrome version 155.0.8059.39 or later","detection":"No reliable host or network indicator is derivable from the published description.","tags":["authorization","filesystem","browser"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:56:51.973Z"}}