CVE-2026-106237 is an information leak in the Permissions component of Google Chrome before 155.0.8059.39. NVD scores it 9.6 critical while Chromium rates it Low. The record says a remote attacker could bypass site isolation through a crafted HTML page. Update Chrome to 155.0.8059.39 or later.
What's affected
Google Chrome on Windows, Mac and Linux before 155.0.8059.39. Per the Chrome stable channel post, the fixed build is 155.0.8059.39 on Linux and 155.0.8059.39 or .40 on Windows and Mac.
Other Chromium based browsers take the fix on their own schedule, so check each vendor's release notes for the matching Chromium version before you assume you are covered.
How to check if you're exposed
Open chrome://settings/help and compare the version number with the fixed build above. The page also triggers the update check. On Linux you can read the installed version from a terminal:
google-chrome --version
For managed fleets, use your browser management console or endpoint inventory to list Chrome versions and filter for anything older than the fixed build. Chrome only applies an update after a relaunch, so a machine that has downloaded the update can still be running the old build.
What to do now
- Update Chrome to 155.0.8059.39 or later and relaunch the browser.
- Report browsers that have not relaunched in more than a few days, since they still run the old code.
- Check Chromium based browsers and embedded Chromium in desktop apps, and update them when the vendor ships the matching release.
- Keep automatic updates on, and avoid pinning old Chrome builds in managed images.
Why it matters
The weakness class is CWE-200. An information leak means one origin can learn data it should not be able to see. Here the record says the leak allows a site isolation bypass, which is the protection that keeps content from different websites in separate processes.
The score gap is worth knowing about. NVD assigns a 9.6 base score with a changed scope, while Chromium itself labels the bug Low. Both can be true, since the Chromium rating reflects how hard the flaw is to use in practice.
The record describes it as reachable from a crafted web page, with no prior foothold required. Browser bugs of this kind matter because the sandbox and site isolation are the main containment layers between a hostile web page and the rest of the machine. When one of them has a hole, the next bug in the chain gets more room to work.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited. Treat it as a routine but urgent update.
Quick check
Do I need to do anything besides update?
No special mitigation is described. Update and relaunch Chrome, then confirm the version on the About page.
Why is the NVD score so high for a Low Chromium rating?
NVD scores the worst case impact of the vector, including changed scope. Chromium rates real world severity using its own criteria. Use the Chromium rating for urgency and the NVD score for reporting.
Sources
Last reviewed: 19 October 2026.
