CVE-2026-106195: Google Chrome Chromoting Incorrect Authorization Vulnerability
CVE-2026-106195 is an incorrect authorization flaw in the Chromoting component of Google Chrome on Mac, affecting builds prior to 155.0.8059.39. According to the record, a remote attacker can bypass system access restrictions through crafted network traffic. NVD assigns a 9.1 score, while Chromium rates the security severity as Low, and the record shows no confirmed exploitation.
Overview
CVE-2026-106195 is an incorrect authorization issue (CWE-863) in the Chromoting component of Google Chrome on Mac. The record was published on 2026-10-06 by the Chrome CNA, and its description states that the flaw affects builds prior to 155.0.8059.39.
Impact
According to the description, a remote attacker can bypass system access restrictions by sending crafted network traffic. NVD assigns a CVSS base score of 9.1. The vector in the record describes a network attack vector, no privileges required, no user interaction, high confidentiality and integrity impact, and no availability impact.
Affected products and versions
- Google Chrome on Mac, prior to 155.0.8059.39, as stated in the description.
- The structured affected data contains a range below 155.0.8059.39 and a second range that is empty because it starts and ends at the same version. Read the structured data with this inconsistency in mind.
Exploitation status
The CISA KEV catalog does not list this CVE in the record. The SSVC fields show exploitation as none and automatable as yes. The EPSS probability is 0.00309 with a percentile of 0.22579, dated 2026-10-23. No confirmed exploitation appears in the record.
Remediation and mitigation
- Update Google Chrome on Mac to 155.0.8059.39 or a later build, as indicated by the prior to wording of the description.
- Review the Chrome stable channel release notes linked in the references to confirm which build contains the fix.
- Where remote access features are not required, consider restricting their use until affected systems are updated.
Detection guidance
- Inventory Mac endpoints and compare the installed Chrome build with the fixed version.
- Monitor for unexpected remote access sessions or unusual inbound network activity directed at managed Mac systems.
- Use centralized update management to verify that the fix has reached all endpoints.
Limitations of the available information
The record has no fixed-version field, so the fixed build is inferred from the description. The title field was empty and was written from the record content. The NVD score of 9.1 differs from the Chromium security severity of Low, and the record does not explain the difference. The record provides no technical details about the root cause or exploit conditions.
Frequently asked questions
Is this vulnerability being actively exploited?
The record does not list this CVE in the CISA KEV catalog, and it shows no confirmed exploitation. Monitor official sources for changes.
Which build addresses the issue?
The description states that builds prior to 155.0.8059.39 are affected, so updating to 155.0.8059.39 or a later build is the inferred remediation. Confirm against the linked release notes.
Why do the severity ratings differ?
NVD assigns a 9.1 score, while Chromium rates the security severity as Low. The record does not explain this difference.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.