CVE-2026-106280 Google CVE debrief

Who should care

Google Chrome users, particularly those with exposure to untrusted or user-supplied content, should assess their exposure and verify their version of Chrome. This includes Chrome users who handle sensitive data, Chrome administrators responsible for updating and securing Chrome deployments, and security teams monitoring for potential bypass of web origin policy.

Why it matters

CVE-2026-106280 is a Medium-severity vulnerability in Google Chrome's PermissionElement that allows remote attackers to potentially bypass web origin policy. Chrome users should verify their version and assess exposure to untrusted content.

• Potential bypass of web origin policy
• Increased risk of unauthorized access to sensitive data
• Possible exploitation by remote attackers
• Verification of Chrome version and exposure required

Technical summary

The vulnerability is caused by incorrect authorization in PermissionElement in Google Chrome prior to version 155.0.8059.39. This allows remote attackers to potentially bypass web origin policy via a crafted HTML page. The vulnerability has a Medium security severity rating according to Chromium. Chrome users should verify their version and assess exposure to untrusted content, particularly those with exposure to user-supplied content. The CVE Program and NVD records provide source-provided CVE metadata and official vulnerability assessment.

Defensive priority

Medium priority for Chrome users to verify and update to version 155.0.8059.39 or later.

Recommended defensive actions

• Verify and update Google Chrome to version 155.0.8059.39 or later
• Review and assess exposure to the vulnerability
• Monitor for potential bypass of web origin policy
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the incorrect authorization vulnerability in Google Chrome's PermissionElement. Chromium security severity is rated as Medium. The vulnerability is caused by incorrect authorization in PermissionElement in Google Chrome prior to version 155.0.8059.39. This allows remote attackers to potentially bypass web origin policy via a crafted HTML page. The CVE Program and NVD records provide source-provided CVE metadata and official vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.