CVE-2026-106367

Summary

A missing authorization check in Google Chrome's mobile browser on Android allowed attackers to execute arbitrary code outside the sandbox through a co-installed app, potentially leading to full system compromise.

Exploitability

Exploitation requires social engineering to convince a user to install a malicious co-app, with no additional privileges needed once the app is installed, making it moderately difficult to exploit but highly effective when successful.

Blast radius

The vulnerability affects all Android users running Chrome versions prior to 155.0.8059.39, potentially exposing millions of devices to remote code execution through a simple co-installation attack.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Chrome for Android version 155.0.8059.39 or later to remediate this authorization bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.