CVE-2026-106221

Summary

A confused deputy vulnerability in Chrome's WebAPK implementation on Android allows remote attackers to bypass web origin policies through social engineering. This occurs when the system incorrectly delegates authority from one entity to another, enabling crafted HTML pages to manipulate the browser's security context.

Exploitability

Exploitation requires social engineering to convince users to visit a malicious webpage, making it moderately difficult but not highly complex to achieve in practice.

Blast radius

If exploited, this vulnerability could allow attackers to perform cross-origin operations on behalf of trusted web applications, potentially leading to data theft or unauthorized actions within those applications.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Chrome for Android version 155.0.8059.39 or later to remediate this confused deputy vulnerability in WebAPKs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.