CVE-2026-106198 is a high severity flaw (CVSS 8.2) in the FileSystem component of Google Chrome. Chromium rates its own severity as Medium. The fix is Chrome 155.0.8059.39, so update the browser to that version or later.
What's affected
The record lists versions of Chrome before 155.0.8059.39 as affected. Google's stable channel post of 6 October 2026 lists CVE-2026-106198 as a Medium severity item and says the stable channel moved to 155.0.8059.39 and .40 for Windows and Mac and 155.0.8059.39 for Linux, rolling out over days and weeks. That post is titled for the desktop channel, so for the mobile build confirm the exact version in the Chrome for Android or iOS release notes and in your store listing.
Two severities. The CVSS score in the record is 8.2 (High). Chromium labels the same issue Medium, because its rating reflects what an attacker needs in practice. Both are useful: the score describes the worst case on paper and the Chromium label describes how Google weighs it. Patch on the normal browser cycle if you manage devices, and do not wait for a quiet week.
The weakness is CWE-862, missing authorization. The record says the attacker must already have compromised the renderer process. From there, a crafted HTML page can bypass web origin policy. The scope in the vector is changed, which is why the score is 8.2.
How to check if you're exposed
Open chrome://version on the device or browser and read the version number. Anything below 155.0.8059.39 is behind the fix. On a managed fleet, use your device management console to report the Chrome version per device and filter for older builds.
For Chrome on mobile, open the app store page and check that the installed version is current, or read the version under Settings, then About Chrome. Because the record names this platform specifically, there is no need to chase it on other operating systems, but desktop and mobile builds are updated together in the same release train.
Browsers also live inside other products. Electron apps, embedded web views and kiosk images can bundle their own Chromium, which updates on a different schedule from Chrome itself. Ask your vendors which Chromium version they ship if that matters to you.
What to do now
- Update Chrome to 155.0.8059.39 or later and restart the browser, since the update does not apply until the browser relaunches.
- On managed devices, push the update through your device management tool and set a short deadline for restart.
- Report the installed Chrome version across your fleet and list any device that is still behind after a week.
- Ask the vendor of any embedded Chromium product in your estate which build they ship.
- Keep automatic browser updates turned on, because Chrome ships security fixes in most releases.
Why it matters
Chrome splits work across processes. The renderer, which runs web content, is treated as hostile, and a more privileged browser process decides what the renderer is allowed to ask for. A flaw that needs a compromised renderer is therefore a second stage in a chain: the attacker first needs a separate bug to take over the renderer, and only then does this one matter.
That is the reason Chromium rates it Medium while the CVSS score reads 8.2. The score assumes the first stage has happened. In practice, a defender should still patch it, because exploit chains are built from exactly these pieces, and the browser process check that should have refused the request is the safety net.
The FileSystem component handles web access to storage. A missing authorization check there lets a renderer reach across the origin boundary, which is the barrier that keeps one site's data away from another. The class is CWE-862 again, and the fix is to add the missing check.
Quick check
Does an attacker need to compromise the renderer first?
Yes. The record says the attacker has already compromised the renderer process. The flaw is a second step, not a first foothold.
Is this CVE known to be exploited?
The record does not flag it as known exploited, and the Chrome release post we read does not say so. The post notes that bug details can stay restricted until most users have updated.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
