CVE-2026-106287

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: Chrome

Description

Information loss in CORS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106287

EUVD

EUVD-2026-93604

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 155.0.8059.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-221	The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.

Attack-Flow Graph

Executive Summary

This vulnerability involves information loss in CORS (Cross-Origin Resource Sharing) in Google Chrome versions before 155.0.8059.39. It allows a remote attacker to bypass web origin policy by manipulating network traffic, potentially exposing sensitive data across different origins.

Detection Guidance

This vulnerability is specific to Google Chrome versions prior to 155.0.8059.39. Detection involves checking the installed Chrome version. On Windows, run: chrome://version/ in the browser. On Linux/macOS, check via terminal with commands like 'google-chrome --version' or 'chromium-browser --version'. If the version is below 155.0.8059.39, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow attackers to access data from one website while you are logged into another, leading to unauthorized data exposure or theft. Users of affected Chrome versions may be at risk of privacy breaches or session hijacking.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles or HIPAA's safeguards for protected health information. Organizations using affected Chrome versions may face compliance risks and potential penalties.

Mitigation Strategies

Update Google Chrome to version 155.0.8059.39 or later to address the CORS information loss vulnerability.

Hi! I’m here to help you understand CVE-2026-106287. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70