Google Chrome: Incorrect authorization allows site isolation bypass
Summary
Google Chrome contains an incorrect authorization flaw in its Actor component, tracked as CVE-2026-106199. According to the CVE description, a remote attacker who has already compromised the renderer process could potentially bypass site isolation using a crafted HTML page. The Chromium security severity is rated Low, and the NVD CVSS score is 8.2 because the flaw is chained with a separate browser exploit.
Affected
- Google Chrome on Android before 155.0.8059.39 (per CVE description)
- Desktop scope is unconfirmed: CIS lists Chrome before 155.0.8059.39/.40 for Windows and Mac
- Chromium packages in Debian: before 155.0.8059.39-1~deb12u1
- Microsoft Edge (Chromium-based): Tenable listing references Edge before 155.0.4283.62
Fixed in
- Chrome for Android: 155.0.8059.39 or later
- Chrome desktop: 155.0.8059.39/.40 or later (secondary coverage)
- Later stable builds exist, e.g. 155.0.8059.79/.80 for Windows and Mac, 155.0.8059.79 for Linux (Malwarebytes, 13-14 Oct 2026)
- Ubuntu: chromium-browser packages marked not affected (snap packaging)
Workaround
- Unknown. No vendor workaround found.
- Not needed where a patched build is installed.
- For managed devices, enforce automatic updates via Google Play (Android) or the browser update channel (desktop).
Exploitation
- No evidence of exploitation in the wild found; not listed in CISA KEV at the time of research.
- CIS reports no known exploitation for this group of Chrome bugs.
- No public proof-of-concept found. VulDB reports no exploit available.
- EPSS values are low (0.21% on GitHub, 0.00248 on Vulners).
Our recommendation
- Update all Chrome and Edge installations to the latest 155.x build, not only the minimum version.
- Enforce automatic browser updates on managed Android and desktop devices.
- Check the browser versions on all endpoints, including mobile devices.
- Monitor vendor advisories for new reports of exploitation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chrome Releases: Chrome for Android update chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Debian OSV osv.dev
- Ubuntu security notice ubuntu.com
- CIS advisory www.cisecurity.org
- VulDB vuldb.com
- Malwarebytes: Chrome fixes 37 security flaws www.malwarebytes.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:00.
Original description (NVD)
Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.