CVE-2026-106381 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome on iOS deployments should assess exposure and prioritize updates to version 155.0.8059.39 or later. This includes IT teams managing Chrome on iOS, security teams monitoring for potential policy bypass, and operators responsible for ensuring proper authorization and policy enforcement. Defenders must assess exposure for users accessing Chrome on iOS to ensure proper authorization and policy enforcement.

Why it matters

CVE-2026-106381 is an incorrect authorization vulnerability in Google Chrome on iOS that allows remote attackers to bypass web origin policy. Defenders should prioritize verifying and updating Chrome on iOS, assess exposure, and monitor for potential policy bypass.

• Verification of Google Chrome on iOS version 155.0.8059.39 or later is required to prevent potential bypass of web origin policy.
• Defenders must assess exposure for users accessing Chrome on iOS to ensure proper authorization and policy enforcement.
• Successful exploitation could allow remote attackers to bypass web origin policy, potentially leading to unauthorized access or data exposure.

Technical summary

The vulnerability is caused by incorrect authorization in Passwords in Google Chrome on iOS prior to version 155.0.8059.39. This allows remote attackers to bypass web origin policy via crafted HTML pages. The incorrect authorization in Passwords affects Google Chrome on iOS, specifically versions prior to 155.0.8059.39. Defenders should prioritize verifying and updating Google Chrome on iOS to version 155.0.8059.39 or later, and assess exposure for users accessing Chrome on iOS. Successful exploitation could allow remote attackers to bypass web origin policy, potentially leading to unauthorized access or data exposure.

Defensive priority

Defenders should prioritize verifying and updating Google Chrome on iOS to version 155.0.8059.39 or later, and assess exposure for users accessing Chrome on iOS.

Recommended defensive actions

• Verify and update Google Chrome on iOS to version 155.0.8059.39 or later
• Assess exposure for users accessing Chrome on iOS
• Monitor for potential bypass of web origin policy
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD records provide details on the incorrect authorization vulnerability in Google Chrome on iOS. However, additional information on potential exploitation or impact is limited. Defenders should verify and update Google Chrome on iOS to version 155.0.8059.39 or later, assess exposure for users accessing Chrome on iOS, and monitor for potential bypass of web origin policy. The source details provided do not specify the full scope of affected systems or components, so defenders must consider potential exposure based

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.