CVE-2026-106191

Summary

A missing authorization check in Google Chrome's Actor component allowed attackers who already compromised the renderer process to execute arbitrary code outside the sandbox, potentially leading to full system compromise. This vulnerability acts as a privilege escalation vector from renderer to system-level access.

Exploitability

Exploitation requires an attacker to first compromise the renderer process, then craft a malicious HTML page that triggers the authorization bypass, making it moderately difficult but achievable with a multi-stage attack approach.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the user's system with full privileges, potentially leading to complete system compromise, data theft, or persistent backdoor installation.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Google Chrome version 155.0.8059.39 or later to remediate this authorization bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.