Google Chrome for Android: Missing authorization in Mobile component
Summary
A missing authorization check in the Mobile component of Google Chrome for Android allows a local attacker to potentially execute arbitrary code outside the browser sandbox. The attacker needs a malicious co-installed app on the device and must use social engineering to get the user to install it. The CVSS vector lists no user interaction, but the description requires it, so the real-world risk is likely lower than the score suggests.
Affected
- Google Chrome for Android before 155.0.8059.39
- Unknown for other platforms (the CVE record covers Android only)
Fixed in
- Google Chrome for Android 155.0.8059.39 or later
- A later build, 155.0.8059.79, is reported by third-party sources but not verified against Google's pages
Workaround
- Unknown. No vendor workaround has been published; a patch is available.
Exploitation
- Not marked as known exploited in the sources reviewed (not checked against the CISA KEV catalogue directly)
- No public proof of concept found
- Google's advisory does not state whether the flaw was exploited in the wild
Our recommendation
- Update Chrome for Android to the latest Stable build via Google Play, prioritising BYOD and unmanaged devices
- Check MDM or Play Store compliance reports for outdated Chrome versions
- Allow app installs only from the official store and keep Google Play Protect enabled
- Train staff not to install unknown apps, including on personal devices
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop (CVE reference) chromereleases.googleblog.com
- VulnCheck/Vulners CVE-2026-106367 record vulners.com
- OpenCVE CVE-2026-106367 app.opencve.io
- HOL Guard CVE-2026-106367 (CISA ADP Vulnrichment) hol.org
- OffSeq Radar CVE-2026-106367 radar.offseq.com
- Malwarebytes: Chrome and ChromeOS security update www.malwarebytes.com
- GHacks: Chrome 155 security fixes www.ghacks.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:47.
Original description (NVD)
Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.