{"id":"CVE-2026-106221","published":"2026-10-06T19:17:48.783","lastModified":"2026-10-09T02:16:58.310","description":"Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","cvssScore":8.3,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","cwes":["CWE-441"],"vendors":["google"],"products":["chrome","android"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/540049672","tags":["Permissions Required"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A confused deputy vulnerability in Chrome's WebAPK implementation on Android allows remote attackers to bypass web origin policies through social engineering. This occurs when the system incorrectly delegates authority from one entity to another, enabling crafted HTML pages to manipulate the browser's security context.","exploitability":"Exploitation requires social engineering to convince users to visit a malicious webpage, making it moderately difficult but not highly complex to achieve in practice.","blast_radius":"If exploited, this vulnerability could allow attackers to perform cross-origin operations on behalf of trusted web applications, potentially leading to data theft or unauthorized actions within those applications.","remediation":"Upgrade to Chrome for Android version 155.0.8059.39 or later to remediate this confused deputy vulnerability in WebAPKs.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","origin-policy","confused-deputy"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:56:16.251Z"}}