CVE-2026-106199

Summary

A permission bypass flaw in Google Chrome's Actor component on Android allows remote attackers to circumvent site isolation protections when they already control the renderer process. This could enable attackers to access data from other websites or tabs.

Exploitability

Exploitation requires a compromised renderer process, making it moderately difficult but possible for attackers who already have initial access to execute code in the renderer context and then leverage this flaw to bypass site isolation protections.

Blast radius

The vulnerability affects all Android users running Chrome versions prior to 155.0.8059.39, potentially exposing their browsing sessions to cross-site data leakage and session hijacking attacks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Chrome for Android version 155.0.8059.39 or later

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.