CVE-2026-106271

Summary

A missing authorization check in Chrome's Workers feature allowed attackers who already compromised the renderer process to bypass site isolation when processing crafted PDF files. This creates a path for privilege escalation and cross-site data access.

Exploitability

Exploitation requires an initial compromise of the renderer process, making it moderately difficult but possible with a successful PDF-based attack vector.

Blast radius

If exploited, this flaw could allow attackers to access data from other websites, potentially leading to credential theft, session hijacking, or sensitive data exposure across multiple sites.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Chrome 155.0.8059.39 or later

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.