CVE-2026-106367

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-14

Assigner: Chrome

Description

Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106367

EUVD

EUVD-2026-93742

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 155.0.8059.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability involves missing authorization checks in Google Chrome on Android. A local attacker could exploit this by using a co-installed malicious app to bypass sandboxing and potentially execute arbitrary code outside the app's intended boundaries.

Detection Guidance

This vulnerability involves missing authorization in Google Chrome on Android, allowing local attackers to execute code via a co-installed app. Detection requires checking Chrome version and app permissions. Verify Chrome version is 155.0.8059.39 or higher. Check installed apps for suspicious permissions or unknown sources.

Impact Analysis

If you have Google Chrome on Android installed, a malicious app on your device could exploit this to run unauthorized code, potentially accessing sensitive data or performing actions without your knowledge.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves a local attacker leveraging social engineering to execute arbitrary code outside the sandbox via a co-installed app. Compliance impacts would depend on how the vulnerability is exploited in a specific environment.

Mitigation Strategies

Update Google Chrome on Android to version 155.0.8059.39 or later to address the missing authorization issue.

Hi! I’m here to help you understand CVE-2026-106367. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70