CVE Intelligence
Analysis AI-assisted

CVE-2026-106323: Google Chrome for iOS Missing Authorization (CWE-862)

CVE-2026-106323 is a missing authorization issue (CWE-862) in Chrome for iOS within Google Chrome, affecting builds prior to 155.0.8059.39. The record describes possible arbitrary code execution outside the sandbox when a user is lured into opening a crafted HTML page, with a CVSS 3.1 base score of 9.6. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes a missing authorization issue (CWE-862) in Chrome for iOS within Google Chrome. According to the description, a remote attacker who uses social engineering and a crafted HTML page could potentially execute arbitrary code outside the sandbox.

Impact

  • The record assigns a CVSS 3.1 base score of 9.6 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, and the same score appears from the CISA-ADP provider.
  • The SSVC data in the record lists technical impact as total, exploitation as none and automatable as no.
  • Because the vector requires user interaction, practical risk depends on users opening attacker-controlled content.

Affected products and versions

  • Product: Google Chrome, including Chrome for iOS.
  • The description states that versions prior to 155.0.8059.39 are affected.
  • The record's affected list contains a second entry with the same endpoint (above or equal to 155.0.8059.39 and before 155.0.8059.39), which is internally contradictory. Do not rely on it to define ranges until the vendor data is clarified.
  • The record's fixes list is empty. The version 155.0.8059.39 is the boundary given in the description.

Exploitation status

  • The record shows the vulnerability is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is 0.00326 with percentile 0.24445, dated 2026-10-23. These are probability scores, not versions.

Remediation and mitigation

  • Update Chrome for iOS to 155.0.8059.39 or later. Review the Chrome release notes for details.
  • Confirm the installed build on managed devices and track devices that have not updated.
  • Reinforce user awareness: the attack depends on social engineering, so untrusted links and pages are a risk factor.

Detection guidance

  • Inventory devices running Chrome for iOS and compare each installed build against 155.0.8059.39.
  • Review reports of unexpected browser behavior after users visit unfamiliar links, at a high level, without relying on specific indicators that the record does not provide.

Limitations of the available information

  • The record does not include technical details of the flaw, the affected component, or reproduction conditions beyond the description.
  • The Chromium issue tracker entry is marked as requiring permissions, so its details may not be publicly available.
  • The fixes list is empty, so the record does not formally link a patch. The fixed build comes from the description wording.
  • Whether other requirements beyond social engineering and user interaction apply is unknown.

Frequently asked questions

What does CVE-2026-106323 affect?

The record describes Chrome for iOS within Google Chrome and states that versions prior to 155.0.8059.39 are affected.

Is this vulnerability being actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Update Chrome for iOS to 155.0.8059.39 or later, confirm installed builds on managed devices, and reinforce user awareness about untrusted links and pages.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.