CVE-2026-106267 in Chrome
Summary
by MITRE • 10/06/2026
Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as missing authorization within the network subsystem of Google Chrome prior to version 155.0.8059.39 represents a critical failure in access control mechanisms that govern inter-process communication and resource handling. This flaw specifically impacts the browser's ability to enforce strict boundaries between different execution contexts, particularly when dealing with network requests initiated by compromised renderer processes. In modern web browsers like Chrome, site isolation is a fundamental security architecture designed to prevent cross-site scripting attacks from accessing sensitive data belonging to other sites. By ensuring that each website runs in its own unique process or isolated context, the browser limits the damage an attacker can cause if they successfully exploit a vulnerability within one tab or frame. However, this protection relies heavily on rigorous authorization checks at every layer of the stack, including the network service which handles all HTTP and HTTPS traffic.
The technical flaw lies in the insufficient validation of permissions when a renderer process attempts to interact with the network service. Under normal circumstances, if a renderer process is compromised by an attacker executing malicious JavaScript or HTML, it should be restricted from performing actions that could leak data across site boundaries. The missing authorization check allows such a compromised renderer to bypass these restrictions by crafting specific HTTP requests or manipulating network state in ways that were not intended by the browser's security model. This effectively neutralizes the protections offered by cross-origin isolation policies, allowing an attacker to potentially access cookies, local storage, or other sensitive data associated with different origins than the one currently being viewed. The severity is classified as medium because while it bypasses a key defense layer, successful exploitation typically requires prior compromise of the renderer process through another vulnerability or social engineering tactic.
From an operational impact perspective, this vulnerability undermines the core promise of site isolation in Google Chrome. An attacker who has achieved code execution within a renderer process can leverage this flaw to exfiltrate sensitive information from other tabs or windows that are open but belong to different domains. This could lead to session hijacking, where stolen cookies allow an attacker to impersonate a user on their banking or email accounts. It also facilitates cross-site request forgery attacks with elevated privileges and may enable the reading of private data stored in browser storage mechanisms. The ability to bypass site isolation significantly expands the attack surface for remote attackers, turning what might have been contained within a single tab into a broader compromise affecting multiple sites accessed by the user during their browsing session.
This issue aligns closely with CWE-284 Improper Access Control and falls under the MITRE ATT&CK technique of T1059 Command and Scripting Interpreter for initial access, followed by techniques related to data exfiltration over a common protocol such as HTTP or HTTPS. The lack of proper authorization checks is a classic example of how insufficient validation can lead to privilege escalation within an application's internal architecture. To mitigate this risk, users must ensure that their Google Chrome installation is updated to version 155.0.8059.39 or later immediately upon availability. Developers and security teams should also review any custom extensions or plugins installed in the browser, as these can sometimes introduce similar access control weaknesses if they do not adhere to strict sandboxing principles. Regularly updating browsers is the most effective defense against such vulnerabilities that exploit architectural assumptions about process isolation and network request handling.