CVE-2026-106301

Summary

A confused deputy vulnerability in Chrome's Contextual Tasks feature allows remote attackers to bypass system access restrictions by tricking the browser into making privileged requests on their behalf. This could enable attackers to access restricted system resources or perform actions with elevated privileges.

Exploitability

Exploitation requires compromising the renderer process first, then crafting a malicious HTML page that triggers the confused deputy scenario, making it moderately difficult but achievable in targeted attacks.

Blast radius

If exploited, this vulnerability could allow attackers to access sensitive system resources or perform privileged actions across multiple Chrome sessions, potentially affecting all users of the compromised browser instance.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Google Chrome 155.0.8059.39 or later

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.