CVE-2026-106425: 
Google Chrome vulnerability analysis and mitigation

CVE-2026-106425 is a missing authorization vulnerability in the BrowserTag component of Google Chrome that allows a remote attacker who has already compromised the renderer process to bypass Chrome's site isolation security feature via a crafted HTML page, with social engineering required. It affects all versions of Google Chrome prior to 155.0.8059.39. The vulnerability was reported internally by Google on 2026-04-12 and patched on 2026-10-06 as part of a large stable channel update. It carries a CVSS v3.1 base score of 4.2 (Medium) (Chrome Releases, Feedly).

The root cause is classified as CWE-862 (Missing Authorization) in Chrome's BrowserTag component, which fails to enforce proper authorization checks when handling certain operations from a compromised renderer process. An attacker who has already achieved renderer process compromise can craft a malicious HTML page that, when visited by a user (requiring social engineering), exploits the missing authorization check to circumvent Chrome's site isolation mechanism. Site isolation is a critical security boundary that prevents cross-origin data access between different web origins; bypassing it could allow a compromised renderer to interact with resources from other sites. The Chromium issue tracker reference for this bug is #501790682 (Chrome Releases).

Successful exploitation allows an attacker with a pre-compromised renderer process to bypass Chrome's site isolation, potentially enabling cross-origin data access that would otherwise be blocked. The primary impact is a limited confidentiality and integrity breach (CVSS scores both Low), with no availability impact. Because site isolation is a defense-in-depth mechanism, bypassing it could facilitate reading sensitive data from other origins (e.g., session tokens, page content) or performing unauthorized cross-origin actions, though the overall impact is constrained by the prerequisite of renderer compromise and user interaction (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). Exploitation requires two significant preconditions: the attacker must have already compromised the Chrome renderer process (a high bar), and must also trick the user into visiting a crafted HTML page via social engineering. The EPSS score is approximately 0.189%, reflecting low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Chromium rates this as Medium severity (Chrome Releases).

Google has released a patch in Chrome stable channel version 155.0.8059.39 (Linux) and 155.0.8059.39/.40 (Windows/Mac), which addresses this and 246 other security issues. Users and administrators should update Chrome to version 155.0.8059.39 or later immediately via Chrome's built-in update mechanism or enterprise deployment tools. No configuration-based workaround is available; upgrading is the only remediation. Organizations should also implement security awareness training to reduce the effectiveness of social engineering tactics that this vulnerability relies upon (Chrome Releases).

The CIS Security advisory noted that the broader Chrome 155.0.8059.39 update, which includes this fix, could allow for arbitrary code execution in the context of other vulnerabilities patched in the same release (CIS Advisory). OpenSUSE issued security announcements for Chromium packages addressing this and related CVEs. No notable independent researcher commentary or significant social media discussion specific to CVE-2026-106425 has been identified, consistent with its medium severity and complex exploitation prerequisites.