{"id":"CVE-2026-106301","published":"2026-10-06T19:17:58.153","lastModified":"2026-10-08T13:02:13.510","description":"Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cwes":["CWE-441"],"vendors":["google"],"products":["chrome"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/523750306","tags":["Permissions Required"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A confused deputy vulnerability in Chrome's Contextual Tasks feature allows remote attackers to bypass system access restrictions by tricking the browser into making privileged requests on their behalf. This could enable attackers to access restricted system resources or perform actions with elevated privileges.","exploitability":"Exploitation requires compromising the renderer process first, then crafting a malicious HTML page that triggers the confused deputy scenario, making it moderately difficult but achievable in targeted attacks.","blast_radius":"If exploited, this vulnerability could allow attackers to access sensitive system resources or perform privileged actions across multiple Chrome sessions, potentially affecting all users of the compromised browser instance.","remediation":"Upgrade to Google Chrome 155.0.8059.39 or later","detection":"No reliable host or network indicator is derivable from the published description.","tags":["browser","privilege-escalation","contextual-tasks"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:58:21.479Z"}}