CVE-2026-106237 in Chrome
Summary
by MITRE • 10/06/2026
Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an information leak within the permissions system of Google Chrome versions preceding 155.0.8059.39 represents a significant deviation from expected browser security boundaries, specifically targeting the site isolation mechanism. Site isolation is a critical defense-in-depth strategy employed by modern web browsers to prevent cross-site scripting and data theft attacks by ensuring that each website runs in its own separate process with distinct memory spaces. This architectural separation prevents malicious scripts on one origin from accessing sensitive data belonging to another origin, even if they are rendered within the same browser window or tab. The flaw described indicates a failure in this isolation boundary, allowing a remote attacker who crafts a specific HTML page to exploit weaknesses in how permissions and context boundaries are enforced during rendering and execution phases.
From a technical perspective, the core issue lies in the improper handling of permission states when interacting with cross-origin resources. When a user visits a maliciously crafted webpage, the browser's engine may inadvertently expose internal state information or allow script execution contexts to leak across origin boundaries due to flawed logic in the permissions API implementation. This leakage effectively undermines the sandboxing model that Chrome relies upon to contain potential exploits within individual tabs or processes. By bypassing site isolation, an attacker can potentially access cookies, local storage data, DOM elements, or other sensitive information associated with a different trusted website that is open in another tab or window. The severity of this flaw is classified as low by the Chromium security team, likely because successful exploitation requires specific user interaction and precise timing, but it remains dangerous due to its potential for facilitating further attacks such as session hijacking or credential theft.
The operational impact of this vulnerability extends beyond simple data exposure. By bypassing site isolation, an attacker can perform cross-site request forgery with greater precision, steal sensitive information from banking or email sites if they are open in the browser simultaneously, and potentially escalate privileges within the web application context. This undermines user trust in the browser's ability to protect their privacy and security. Furthermore, such vulnerabilities often serve as stepping stones for more complex attack chains where initial data leakage is used to refine subsequent exploits against other components of the browser or connected services. The existence of this flaw highlights the complexity involved in maintaining strict separation between web origins, especially when dealing with dynamic content loading and permission grants that change based on user interaction history.
To mitigate the risks associated with this vulnerability, users must ensure they are running Google Chrome version 155.0.8059.39 or later, where these permissions handling logic errors have been corrected. Administrators should enforce automatic update policies to guarantee that all endpoints within their network receive security patches promptly upon release. Additionally, while browser updates address the root cause, users can adopt defensive browsing habits such as avoiding opening sensitive websites in tabs alongside untrusted sites and utilizing privacy-focused extensions that restrict cross-origin data access where possible. From a development standpoint, this incident reinforces the importance of rigorous code review for permission-related APIs and continuous integration testing focused on isolation boundaries to prevent similar regressions in future releases.
This vulnerability aligns with CWE-200, which categorizes information exposure as an issue where sensitive information is disclosed to unauthorized actors without explicit intent. It also relates to ATT&CK technique T1537, which involves communication through a different channel than the primary command and control path, although in this context it more directly supports data exfiltration techniques by allowing access to otherwise isolated memory spaces. Understanding these mappings helps security teams prioritize remediation efforts based on standardized taxonomies that reflect real-world threat actor behaviors and common software weaknesses.