CVE-2026-106297 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome deployments should assess exposure and prioritize updating to the latest version. This includes IT administrators, security teams, and other stakeholders who are responsible for managing and securing Google Chrome deployments. Defenders should also review and implement additional security measures to detect and prevent exploitation attempts. This includes monitoring Google Chrome's official release notes and

Why it matters

CVE-2026-106297 is an incorrect authorization vulnerability in Google Chrome's Scheduling feature that could allow remote attackers to bypass web origin policy. Defenders should prioritize verifying and updating Google Chrome to version 155.0.8059.39 or later.

• Verify and update Google Chrome to version 155.0.8059.39 or later to prevent potential bypass of web origin policy.
• Review and implement additional security measures to detect and prevent exploitation attempts.

Technical summary

The vulnerability is caused by incorrect authorization in Google Chrome's Scheduling feature. This allows a remote attacker to bypass web origin policy via a crafted HTML page. The affected versions are prior to 155.0.8059.39. The vulnerability affects Google Chrome's Scheduling feature, which is used to manage and schedule tasks. The feature is used by various components within the browser, including the browser's built-in scheduler. The vulnerability is rated as Low severity by the Chromium security team. The CVE record and source item provide additional information on the vulnerability, including its impact and affected versions.

Defensive priority

Defenders should prioritize verifying and updating Google Chrome to version 155.0.8059.39 or later to mitigate this vulnerability.

Recommended defensive actions

• Verify and update Google Chrome to version 155.0.8059.39 or later.
• Review and implement additional security measures to detect and prevent exploitation attempts.
• Monitor Google Chrome's official release notes and security advisories for future updates.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to additional information. The CVE record was published on 2026-10-06T18:41:36.240Z and has not been modified since then. The source item provides additional information on the vulnerability, including its impact and affected versions. The vulnerability is rated as Low severity by the Chromium security team. The CVE record and source item do not provide any additional information on the vulnerability's

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.