Google Chrome: Missing authorization in Actor component
Summary
Google Chrome before 155.0.8059.39 contains a missing authorization check in its Actor component (CWE-862). An attacker who has already compromised the renderer process can use a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. The attack has high complexity and requires user interaction. The NVD scores it 8.3; a third-party database shows 4.3.
Affected
- Google Chrome before 155.0.8059.39
- The affected range in the CNA record is inconsistent (155.0.8059.39 to < 155.0.8059.39).
Fixed in
- Google Chrome 155.0.8059.39 (Linux); Windows and macOS builds per Google's Stable Channel Update of October 6, 2026. The Windows and macOS version string needs verification.
- Debian: 155.0.8059.39-1~deb12u1 (bookworm)
- SUSE: chromium 155.0.8059.39
- Use the newest Chrome 155 stable build.
Workaround
- No vendor workaround known; apply the update.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not marked as known exploited by CISA ADP (Vulnrichment); not verified against the KEV catalogue.
- No public proof of concept found.
- EPSS: 0.00357.
Our recommendation
- Update Google Chrome to the newest stable build on all desktops and restart the browser.
- Check the installed version via chrome://settings/help.
- Verify Linux packages and Chromium-based browsers, e.g. Debian or SUSE packages and the Ubuntu snap.
- Monitor for reports of exploitation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- OSV: DEBIAN-CVE-2026-106191 osv.dev
- Ubuntu CVE tracker ubuntu.com
- Vulners: SUSE CVE entry vulners.com
- CISA ADP Vulnrichment summary (HOL) hol.org
- OpenCVE: CVE-2026-106191 app.opencve.io
- Windowsforum: Chrome 155.0.8059.79/.80 update windowsforum.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:13.
Original description (NVD)
Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.