CVE-2026-106221 is a high severity flaw (CVSS 8.3) in the WebAPKs component of Google Chrome on Android. Chromium rates its own severity as Low. The fix is Chrome 155.0.8059.39, so update the browser to that version or later.
What's affected
The record lists versions of Chrome on Android before 155.0.8059.39 as affected. Google's stable channel post of 6 October 2026 lists CVE-2026-106221 as a Low severity item and says the stable channel moved to 155.0.8059.39 and .40 for Windows and Mac and 155.0.8059.39 for Linux, rolling out over days and weeks. That post is titled for the desktop channel, so for the mobile build confirm the exact version in the Chrome for Android or iOS release notes and in your store listing.
Two severities. The CVSS score in the record is 8.3 (High). Chromium labels the same issue Low, because its rating reflects what an attacker needs in practice. Both are useful: the score describes the worst case on paper and the Chromium label describes how Google weighs it. Patch on the normal browser cycle if you manage devices, and do not wait for a quiet week.
The weakness is CWE-441, unintended proxy or intermediary, also called a confused deputy. The record says a remote attacker leveraging social engineering could bypass web origin policy via a crafted HTML page. The vector requires user interaction and shows high confidentiality and integrity impact, which is why the score is 8.3.
How to check if you're exposed
Open chrome://version on the device or browser and read the version number. Anything below 155.0.8059.39 is behind the fix. On a managed fleet, use your device management console to report the Chrome version per device and filter for older builds.
For Chrome on mobile, open the app store page and check that the installed version is current, or read the version under Settings, then About Chrome. Because the record names this platform specifically, there is no need to chase it on other operating systems, but desktop and mobile builds are updated together in the same release train.
Browsers also live inside other products. Electron apps, embedded web views and kiosk images can bundle their own Chromium, which updates on a different schedule from Chrome itself. Ask your vendors which Chromium version they ship if that matters to you.
What to do now
- Update Chrome to 155.0.8059.39 or later and restart the browser, since the update does not apply until the browser relaunches.
- On managed devices, push the update through your device management tool and set a short deadline for restart.
- Report the installed Chrome version across your fleet and list any device that is still behind after a week.
- Ask the vendor of any embedded Chromium product in your estate which build they ship.
- Keep automatic browser updates turned on, because Chrome ships security fixes in most releases.
Why it matters
A WebAPK is how Chrome on Android installs a web app as if it were a native app, with its own icon and launcher entry. That blurs a line users rely on: they treat an installed app differently from a website. A confused deputy flaw in this area means the browser component that creates or runs those apps can be talked into acting with authority that the requesting page should not hold.
The record mentions social engineering, so the attack needs the person to do something. Awareness training helps, but the more reliable control is the patch, since a user cannot be expected to tell a crafted page from a normal one.
If your organisation distributes progressive web apps to staff on Android, consider which of them are installed through Chrome and whether they are reviewed. An inventory of installed web apps is rare, and this class of bug is one reason to want one.
Quick check
Do I need to remove installed web apps?
The record does not call for that. Updating Chrome to 155.0.8059.39 or later is the fix, and a review of which web apps your staff install is a sensible extra.
Is this CVE known to be exploited?
The record does not flag it as known exploited, and the Chrome release post we read does not say so. The post notes that bug details can stay restricted until most users have updated.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
