CVE-2026-106199 is a high severity flaw (CVSS 8.2) in the Actor component of Google Chrome on Android. Chromium rates its own severity as Low. The fix is Chrome 155.0.8059.39, so update the browser to that version or later.
What's affected
The record lists versions of Chrome on Android before 155.0.8059.39 as affected. Google's stable channel post of 6 October 2026 lists CVE-2026-106199 as a Low severity item and says the stable channel moved to 155.0.8059.39 and .40 for Windows and Mac and 155.0.8059.39 for Linux, rolling out over days and weeks. That post is titled for the desktop channel, so for the mobile build confirm the exact version in the Chrome for Android or iOS release notes and in your store listing.
Two severities. The CVSS score in the record is 8.2 (High). Chromium labels the same issue Low, because its rating reflects what an attacker needs in practice. Both are useful: the score describes the worst case on paper and the Chromium label describes how Google weighs it. Patch on the normal browser cycle if you manage devices, and do not wait for a quiet week.
The weakness is CWE-863, incorrect authorization. The record says an attacker who had compromised the renderer process could potentially bypass site isolation via a crafted HTML page. The word potentially matters: the record hedges the outcome.
How to check if you're exposed
Open chrome://version on the device or browser and read the version number. Anything below 155.0.8059.39 is behind the fix. On a managed fleet, use your device management console to report the Chrome version per device and filter for older builds.
For Chrome on mobile, open the app store page and check that the installed version is current, or read the version under Settings, then About Chrome. Because the record names this platform specifically, there is no need to chase it on other operating systems, but desktop and mobile builds are updated together in the same release train.
Browsers also live inside other products. Electron apps, embedded web views and kiosk images can bundle their own Chromium, which updates on a different schedule from Chrome itself. Ask your vendors which Chromium version they ship if that matters to you.
What to do now
- Update Chrome to 155.0.8059.39 or later and restart the browser, since the update does not apply until the browser relaunches.
- On managed devices, push the update through your device management tool and set a short deadline for restart.
- Report the installed Chrome version across your fleet and list any device that is still behind after a week.
- Ask the vendor of any embedded Chromium product in your estate which build they ship.
- Keep automatic browser updates turned on, because Chrome ships security fixes in most releases.
Why it matters
Site isolation puts pages from different sites into different processes, so that a compromised renderer cannot read other sites' data from memory. It is one of Chrome's main defences against a renderer compromise. A flaw that lets a compromised renderer weaken site isolation takes away part of the protection that is supposed to contain such a compromise.
This one is rated Low by Chromium and 8.2 by the CVSS score in the record, which is the widest gap in this group of Chrome issues. The gap exists because the vector assumes the worst case and a changed scope, while Chromium counts how much work an attacker has to do and how likely the bypass is. Neither reading is wrong, and neither tells you to skip the update.
The weakness class is CWE-863, incorrect authorization: a check exists but gives the wrong answer. Fixes for this class usually correct the condition that the check applies. As with the other Chrome fixes in the 6 October release, the job for most teams is confirming browsers have updated and restarted.
Quick check
Is the Low rating a reason to delay?
No. Chromium's Low describes how hard the flaw is to use, not whether to patch. Updates ship together, so there is no extra work in taking this fix.
Is this CVE known to be exploited?
The record does not flag it as known exploited, and the Chrome release post we read does not say so. The post notes that bug details can stay restricted until most users have updated.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
