CVE Intelligence
Analysis AI-assisted

CVE-2026-106241: Google Chrome for Android Search Incorrect Authorization

CVE-2026-106241 is an incorrect authorization flaw (CWE-863) in the Search component of Google Chrome on Android. The record describes a possible arbitrary code execution outside the sandbox through a crafted HTML page used with social engineering. The CNA and CISA-ADP scores are 9.6, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-106241 is an incorrect authorization issue (CWE-863) in the Search component of Google Chrome on Android. According to the record, a remote attacker who uses social engineering could potentially execute arbitrary code outside the sandbox by means of a crafted HTML page. The description gives a Chromium security severity of Medium, while the CNA and CISA-ADP scores are 9.6.

Impact

  • The record describes a potential path to arbitrary code execution outside the browser sandbox.
  • The scoring data indicates that user interaction is required and that the attack is network reachable.
  • The scoring data rates confidentiality, integrity and availability impacts as high.

Affected products and versions

  • Product: Google Chrome on Android.
  • The record lists versions before 155.0.8059.39 as affected.
  • The affected entries also contain a second range that is internally inconsistent; see the limitations section.

Exploitation status

The CISA KEV catalog does not list this CVE, and the SSVC data in the record shows exploitation as none. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Update Google Chrome on Android to 155.0.8059.39 or later, which is the version boundary given in the record.
  • Review the vendor release notes linked in the references for update details.
  • Until the update is applied, limit exposure to untrusted links and pages, since the described attack depends on a crafted HTML page.

Detection guidance

  • Inventory Android devices running Chrome and compare installed versions against 155.0.8059.39.
  • Use mobile device management reporting to find devices that have not received the browser update.
  • Watch for unusual browser crashes or sandbox-related alerts on managed devices, where your tooling supports it.

Limitations of the available information

  • The record contains no entries in its fixes list, so the fixed version is taken only from the affected version range.
  • The affected list includes a range from 155.0.8059.39 and before 155.0.8059.39, which conflicts with the other range.
  • The record does not include a title, so the title was written from the description.
  • Technical details of the vulnerability are not included in the sources consulted.

Frequently asked questions

Is this CVE being exploited?

The CISA KEV catalog does not list it, and no confirmed exploitation appears in the sources consulted.

Which version should I use?

The record points to 155.0.8059.39 as the version boundary, so update Chrome on Android to 155.0.8059.39 or later.

What is the attack path?

The description says the attack involves a crafted HTML page combined with social engineering. Technical details are not included in the record.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.