{"id":"CVE-2026-106199","published":"2026-10-06T19:17:46.133","lastModified":"2026-10-09T02:16:57.967","description":"Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: Low)","cvssScore":8.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","cwes":["CWE-863"],"vendors":["google"],"products":["chrome","android"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/517703787","tags":["Permissions Required"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A permission bypass flaw in Google Chrome's Actor component on Android allows remote attackers to circumvent site isolation protections when they already control the renderer process. This could enable attackers to access data from other websites or tabs.","exploitability":"Exploitation requires a compromised renderer process, making it moderately difficult but possible for attackers who already have initial access to execute code in the renderer context and then leverage this flaw to bypass site isolation protections.","blast_radius":"The vulnerability affects all Android users running Chrome versions prior to 155.0.8059.39, potentially exposing their browsing sessions to cross-site data leakage and session hijacking attacks.","remediation":"Upgrade to Chrome for Android version 155.0.8059.39 or later","detection":"No reliable host or network indicator is derivable from the published description.","tags":["authorization","bypass","chrome"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:56:47.088Z"}}