Google Chrome: Information leak in Permissions enables site isolation bypass
Summary
Google Chrome before 155.0.8059.39 contains an information leak in the Permissions component. A remote attacker can use a crafted HTML page to bypass site isolation, which is meant to separate websites from each other in the browser. Google's own severity rating is Low, while the NVD entry lists CVSS 9.6 (critical); the impact described is information disclosure, not code execution.
Affected
- Google Chrome (desktop) prior to 155.0.8059.39
- Chromium-based packages with the same flaw, for example Debian chromium before 155.0.8059.39-1~deb12u1
- Microsoft Edge: a version before 155.0.4283.62 is reported by Tenable, not verified against Microsoft's advisory
Fixed in
- Google Chrome 155.0.8059.39 (Linux) and 155.0.8059.39/.40 (Windows, macOS) according to the Google advisory
- Later stable builds include the fix; use the latest stable release
- Debian chromium 155.0.8059.39-1~deb12u1
Workaround
Unknown. Google documents no workaround. A third-party source suggests revoking site permissions for websites that may have cached local data; this is generic advice and of limited value.
Exploitation
- CISA SSVC assessment: exploitation none, not automatable, technical impact total
- No evidence of exploitation in the wild in the sources reviewed; not listed in CISA KEV according to a GitHub alert (not checked directly)
- No public proof of concept identified
Our recommendation
- Update Google Chrome, Microsoft Edge and all Chromium-based packages to the latest stable release
- Check managed endpoints for outdated versions and paused update policies
- Verify container images and embedded Chromium components separately
- Do not deprioritise this update, even though the vendor rates it Low
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- OSV: DEBIAN-CVE-2026-106237 osv.dev
- VulDB: CVE-2026-106237 vuldb.com
- Tenable Nessus plugin 366658 www.tenable.com
- Chromium Site Isolation design document chromium.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:18.
Original description (NVD)
Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.