{"id":"CVE-2026-106205","published":"2026-10-06T19:17:46.840","lastModified":"2026-10-08T12:12:27.517","description":"Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cwes":["CWE-862"],"vendors":["google"],"products":["chrome","android"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/519499907","tags":["Permissions Required"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A missing authorization flaw in Google Chrome's password management on Android allowed remote attackers to bypass site isolation when they already had compromised a renderer process, potentially enabling them to access password data from other sites. This represents a privilege escalation vulnerability that could lead to credential theft.","exploitability":"Exploitation requires an initial compromise of the renderer process, making it moderately difficult but not highly complex, with the attacker needing to first gain code execution in the renderer context before leveraging this authorization bypass.","blast_radius":"The impact is significant as compromised Chrome instances on Android could allow attackers to access passwords from multiple websites, potentially leading to widespread credential compromise across different online services.","remediation":"Upgrade to Chrome for Android version 155.0.8059.39 or later","detection":"No reliable host or network indicator is derivable from the published description.","tags":["authorization","password","chrome"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:58:31.381Z"}}