CVE-2026-106196 is a high severity flaw (CVSS 7.6) in the Navigation component of Google Chrome on iOS. Chromium rates its own severity as Medium. The fix is Chrome 155.0.8059.39, so update the browser to that version or later.
What's affected
The record lists versions of Chrome on iOS before 155.0.8059.39 as affected. Google's stable channel post of 6 October 2026 lists CVE-2026-106196 as a Medium severity item and says the stable channel moved to 155.0.8059.39 and .40 for Windows and Mac and 155.0.8059.39 for Linux, rolling out over days and weeks. That post is titled for the desktop channel, so for the mobile build confirm the exact version in the Chrome for Android or iOS release notes and in your store listing.
Two severities. The CVSS score in the record is 7.6 (High). Chromium labels the same issue Medium, because its rating reflects what an attacker needs in practice. Both are useful: the score describes the worst case on paper and the Chromium label describes how Google weighs it. Patch on the normal browser cycle if you manage devices, and do not wait for a quiet week.
The weakness is CWE-862, missing authorization. The record says a remote attacker could bypass web origin policy into a privileged page via a crafted HTML page. User interaction is required, and the vector shows high confidentiality impact with low integrity and availability impact.
How to check if you're exposed
Open chrome://version on the device or browser and read the version number. Anything below 155.0.8059.39 is behind the fix. On a managed fleet, use your device management console to report the Chrome version per device and filter for older builds.
For Chrome on mobile, open the app store page and check that the installed version is current, or read the version under Settings, then About Chrome. Because the record names this platform specifically, there is no need to chase it on other operating systems, but desktop and mobile builds are updated together in the same release train.
Browsers also live inside other products. Electron apps, embedded web views and kiosk images can bundle their own Chromium, which updates on a different schedule from Chrome itself. Ask your vendors which Chromium version they ship if that matters to you.
What to do now
- Update Chrome to 155.0.8059.39 or later and restart the browser, since the update does not apply until the browser relaunches.
- On managed devices, push the update through your device management tool and set a short deadline for restart.
- Report the installed Chrome version across your fleet and list any device that is still behind after a week.
- Ask the vendor of any embedded Chromium product in your estate which build they ship.
- Keep automatic browser updates turned on, because Chrome ships security fixes in most releases.
Why it matters
The same origin policy is the rule that keeps one website from reading or changing another. Browsers apply it in many places. This flaw is a missing authorization check in the Navigation component on iOS, according to the record. When a check is absent, content that should be blocked at the boundary gets through.
Missing authorization is one of the most common weakness classes, in browsers and in ordinary web applications alike. The cause is usually not a clever trick. A code path was added, or an existing path was reached in a new way, and no one asked whether the caller was allowed to do that.
On iOS the control you have is the app version, so keep Chrome current and keep automatic app updates on for managed devices.
Quick check
Why does Chromium call it Medium when the score is High?
Chromium rates severity by what an attacker has to do in practice. The CVSS vector in the record rates the worst case, and the two are different instruments. Read both.
Is this CVE known to be exploited?
The record does not flag it as known exploited, and the Chrome release post we read does not say so. The post notes that bug details can stay restricted until most users have updated.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
