CVE Intelligence
Analysis AI-assisted

CVE-2026-106237: Google Chrome Permissions Information Leak Enabling Site Isolation Bypass

CVE-2026-106237 is an information leak in the Permissions component of Google Chrome before 155.0.8059.39. According to the record, a remote attacker can bypass site isolation through a crafted HTML page. The CVSS score of 9.6 (Critical) from NVD and other providers contrasts with Chromium's own Low security severity label, and no KEV listing or confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-106237 is recorded as an information leak in the Permissions feature of Google Chrome. The record states that a remote attacker can bypass site isolation using a crafted HTML page. Chromium labels its own security severity as Low, while the CVSS score assigned by NVD is 9.6.

Impact

  • The CWE classification is CWE-200, Exposure of Sensitive Information.
  • The CVSS vector reports high confidentiality impact, high integrity impact and low availability impact.
  • The vector also indicates that no privileges are required and that user interaction is required.

Affected products and versions

  • The affected product in the record is Google Chrome.
  • The record describes the affected range as before 155.0.8059.39.
  • The record contains a second range entry that starts at 155.0.8059.39 and ends before 155.0.8059.39, which is an empty range. This is treated as a data inconsistency and not as a separate affected range.
  • The record's fixes list is empty. The description implies that 155.0.8059.39 is the first unaffected build, which is an inference.

Exploitation status

  • The record shows that this CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS probability is 0.00246 with a percentile of 0.15022, dated 2026-10-23.
  • The SSVC fields in the record list exploitation as none and automatable as no.

Remediation and mitigation

  • Update Google Chrome to 155.0.8059.39 or later, which is the boundary given in the description.
  • Confirm the update against the Chrome stable channel release notes.
  • Where updates are delayed, keep browsers on managed update channels and review site permission settings according to organizational policy. The sources do not describe specific workarounds.

Detection guidance

  • Inventory Chrome installations and record their version strings to find builds before 155.0.8059.39.
  • Use endpoint management tools to confirm that browser updates have been deployed across the fleet.
  • The sources do not describe indicators of compromise, so detection at this level relies on version inventory and update telemetry.

Limitations of the available information

  • The record does not include a vendor-provided list of fixed builds beyond the boundary in the description.
  • The affected range in the record contains an inconsistent second entry.
  • The record does not describe the technical mechanics of the issue, and this analysis does not supply them.
  • The Chromium issue tracker entry is referenced, but its content was not part of the record.

Frequently asked questions

Is CVE-2026-106237 being actively exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.

Which Chrome version should I use to address this CVE?

The record describes the affected range as before 155.0.8059.39. Update to 155.0.8059.39 or later and confirm the change against the Chrome stable release notes.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.