CVE-2026-106195 is an incorrect authorization flaw in Chromoting in Google Chrome on Mac before 155.0.8059.39, which could let a remote attacker bypass system access restrictions through crafted network traffic. NVD scores it 9.1, while Chromium rates it Low. Update Chrome to 155.0.8059.39 or later and relaunch.
What's affected
Per the record, Google Chrome on Mac before 155.0.8059.39 is affected. Google's stable channel update for desktop on 6 October 2026 moved the stable channel to 155.0.8059.39 or .40 for Windows and Mac, and 155.0.8059.39 for Linux, rolling out over days and weeks.
The Chrome release notes list the issue as Incorrect authorization in Chromoting, rated Low by Chromium, reported by Google. NVD's CVSS 9.1 is far higher than that rating, so read both before setting priority.
How to check if you're exposed
Check your version at the address chrome://version, or on macOS from the Chrome menu under About Google Chrome, which also triggers the update. Anything older than 155.0.8059.39 is affected.
For a fleet, use your device management tool to report the installed Chrome version on each Mac. Chrome only applies an update when it restarts, so look for machines that have been up for weeks with the browser open.
What to do now
- Update Chrome to 155.0.8059.39 or later on all Macs and relaunch it.
- Use your management tooling to push the update and to report machines that have not yet restarted the browser.
- If you do not use Chrome Remote Desktop, check whether you need it enabled on managed Macs.
- Review which machines allow remote access through Chrome, and turn it off where it is not needed.
- Track the Chrome releases blog for later fixes, since the same update fixed many other issues.
Why it matters
Chromoting is the name used in Chromium for its remote access feature. The record describes an authorization check that lets someone get past system access restrictions through crafted network traffic. It is classed as CWE-863 (incorrect authorization).
The two ratings disagree for a reason. NVD's vector assumes network reach, no login and high impact. Chromium's own rating is Low, which reflects its view of real-world conditions. Neither is wrong, but they are answering different questions, so decide using your own exposure: does the feature run on your Macs?
The record does not report exploitation in the wild, and the KEV flag is false. The same release fixes many other issues, which is reason enough to update.
Quick check
Why does NVD say 9.1 when Chromium says Low?
NVD scores the vector in the abstract. Chromium assigns its own security severity from how it judges real-world risk. Use both: update promptly, and prioritize by whether the remote access feature is in use.
Sources
Last reviewed: 19 October 2026.
