CVE-2026-106205

Summary

A missing authorization flaw in Google Chrome's password management on Android allowed remote attackers to bypass site isolation when they already had compromised a renderer process, potentially enabling them to access password data from other sites. This represents a privilege escalation vulnerability that could lead to credential theft.

Exploitability

Exploitation requires an initial compromise of the renderer process, making it moderately difficult but not highly complex, with the attacker needing to first gain code execution in the renderer context before leveraging this authorization bypass.

Blast radius

The impact is significant as compromised Chrome instances on Android could allow attackers to access passwords from multiple websites, potentially leading to widespread credential compromise across different online services.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Chrome for Android version 155.0.8059.39 or later

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.