CVE-2026-106194

Summary

Chrome's WebAppInstalls feature had missing authorization checks that allowed attackers with compromised renderer processes to execute arbitrary code outside the sandbox via crafted HTML pages. This represents a privilege escalation vulnerability where attackers can bypass Chrome's security boundaries.

Exploitability

Exploitation requires compromising the renderer process first, then using social engineering to convince a user to visit a malicious page, making it moderately difficult but possible with a successful phishing campaign.

Blast radius

The vulnerability affects all Chrome users on versions prior to 155.0.8059.39, potentially allowing attackers to execute arbitrary code on user systems with full browser privileges, including access to local files and network resources.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Chrome 155.0.8059.39 or later immediately

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.