CVE-2026-106205

EUVD-2026-93739 · Published Oct 6, 2026 · 2w ago

Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

Technologies

Google AndroidGoogle Chrome

Weaknesses

CWE-862

CVSS scores

v3.18.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Persistence Stealth Defense Impairment Credential Access

T1190Exploit Public-Facing Application T1211Exploitation for Stealth T1542.002Component Firmware T1556Modify Authentication Process

References

https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html
https://issues.chromium.org/issues/519499907

Potentially impacted assets

See if this affects your attack surface