Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2026-106189: Google Chrome iOS can be tricked to bypass site protection
CVE-2026-106189 · published 29 days ago
Summary
Google Chrome on iOS versions earlier than 155.0.8059.39, as well as the Debian Chromium package built from the same code, can be fooled by a specially crafted web page to break the normal web‑site isolation rules. This could let an attacker run unwanted code and access information from other sites the user is visiting. Update Chrome (or the Debian Chromium package) to the latest version as soon as possible to close the gap.
What to do
- Update google chrome to version 155.0.8059.39 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | chrome | < 155.0.8059.39 | |
| Debian:12 | debian | chromium | All versions |
Original advisory text
DEBIAN-CVE-2026-106189
Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-94Code Injection
Timeline
Published6 Oct 2026
Updated3 Nov 2026
First seen6 Oct 2026
Track software like this
Free during beta