CVE-2026-106188 is a high severity flaw (CVSS 7.1) in the SignIn component of Google Chrome on Android. Chromium rates its own severity as Medium. The fix is Chrome 155.0.8059.39, so update the browser to that version or later.
What's affected
The record lists versions of Chrome on Android before 155.0.8059.39 as affected. Google's stable channel post of 6 October 2026 lists CVE-2026-106188 as a Medium severity item and says the stable channel moved to 155.0.8059.39 and .40 for Windows and Mac and 155.0.8059.39 for Linux, rolling out over days and weeks. That post is titled for the desktop channel, so for the mobile build confirm the exact version in the Chrome for Android or iOS release notes and in your store listing.
Two severities. The CVSS score in the record is 7.1 (High). Chromium labels the same issue Medium, because its rating reflects what an attacker needs in practice. Both are useful: the score describes the worst case on paper and the Chromium label describes how Google weighs it. Patch on the normal browser cycle if you manage devices, and do not wait for a quiet week.
The weakness is CWE-441, unintended proxy or intermediary, also called a confused deputy. The record says a remote attacker could bypass system access restrictions into a privileged page via a crafted HTML page. The CVSS vector requires user interaction, so the person has to open or interact with attacker controlled content.
How to check if you're exposed
Open chrome://version on the device or browser and read the version number. Anything below 155.0.8059.39 is behind the fix. On a managed fleet, use your device management console to report the Chrome version per device and filter for older builds.
For Chrome on mobile, open the app store page and check that the installed version is current, or read the version under Settings, then About Chrome. Because the record names this platform specifically, there is no need to chase it on other operating systems, but desktop and mobile builds are updated together in the same release train.
Browsers also live inside other products. Electron apps, embedded web views and kiosk images can bundle their own Chromium, which updates on a different schedule from Chrome itself. Ask your vendors which Chromium version they ship if that matters to you.
What to do now
- Update Chrome to 155.0.8059.39 or later and restart the browser, since the update does not apply until the browser relaunches.
- On managed devices, push the update through your device management tool and set a short deadline for restart.
- Report the installed Chrome version across your fleet and list any device that is still behind after a week.
- Ask the vendor of any embedded Chromium product in your estate which build they ship.
- Keep automatic browser updates turned on, because Chrome ships security fixes in most releases.
Why it matters
A confused deputy problem happens when a trusted component is tricked into using its authority on behalf of someone who lacks that authority. Here the trusted component is the sign-in flow in the Android browser, and the record says the result is access to a privileged page that normal web content should not reach.
Browsers hold a lot of authority: signed in accounts, saved credentials, internal pages and system integrations. Each of those is guarded by checks that ask who is calling. When one of those checks trusts the wrong caller, a web page can borrow powers it should not have. The vector in the record shows high confidentiality impact, low integrity impact and no availability impact, which is the profile of information exposure more than of device takeover.
For most organisations the practical answer is simple: browsers update themselves, and the work is making sure they actually do. Treat mobile browsers as part of your patch scope, since they are often missing from vulnerability reports that focus on servers.
Quick check
Does this affect Chrome on desktop?
The record names Chrome on Android. The same release also carries many other fixes, so update desktop Chrome as well.
Is this CVE known to be exploited?
The record does not flag it as known exploited, and the Chrome release post we read does not say so. The post notes that bug details can stay restricted until most users have updated.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
