CVE-2026-106198

Summary

Chrome's FileSystem API lacked proper authorization checks, allowing a compromised renderer process to bypass web origin policies and access files from other origins. This creates a path for attackers to escalate privileges and potentially exfiltrate sensitive data.

Exploitability

Exploitation requires compromising the renderer process first, which is moderately difficult but achievable through a previous vulnerability, then crafting a malicious HTML page that triggers the authorization bypass.

Blast radius

The flaw affects all Chrome users who visit malicious websites, with potential for cross-origin data theft and privilege escalation across different web applications.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Chrome version 155.0.8059.39 or later

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.