Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2026-106403: Google Chrome before 155.0.8059.39 can bypass site isolation
CVE-2026-106403 · published 29 days ago
Summary
Chrome versions earlier than 155.0.8059.39 may allow a specially crafted webpage to break the separation between sites if an attacker has already compromised part of the browser. This could let the attacker view information from other sites. Upgrade Chrome to the latest release to close the gap.
What to do
- Update google chrome to version 155.0.8059.39 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | chrome | < 155.0.8059.39 | |
| Debian:12 | debian | chromium | All versions |
Original advisory text
DEBIAN-CVE-2026-106403
Incorrect authorization in Accessibility in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.1
High
Type
CWE-863Incorrect Authorization
Timeline
Published6 Oct 2026
Updated4 Nov 2026
First seen6 Oct 2026
Track software like this
Free during beta