CVE-2026-106390

Analyzed Analyzed - Analysis Complete

Incorrect SanitizerAPI Functionality in Google Chrome Leads to Information Disclosure

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: Chrome

Description

Incorrect provision of specified functionality in SanitizerAPI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106390

EUVD

EUVD-2026-93645

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 155.0.8059.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-684	The code does not function according to its published specifications, potentially leading to incorrect usage.

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in Google Chrome's SanitizerAPI where incorrect functionality allowed a remote attacker to access sensitive information through a specially crafted HTML page.

Detection Guidance

This vulnerability involves incorrect functionality in Google Chrome's SanitizerAPI. Detection primarily requires checking the Chrome version installed on systems. If the version is prior to 155.0.8059.39, the system is vulnerable. No specific network commands are provided for detection beyond verifying the Chrome version.

Impact Analysis

An attacker could exploit this to leak sensitive data from your browser session if you visit a malicious webpage. This may include personal information, login credentials, or other confidential data.

Compliance Impact

This vulnerability involves information leakage via a crafted HTML page in Google Chrome's SanitizerAPI. While not directly tied to compliance standards, such information leaks could potentially violate GDPR's data protection principles or HIPAA's confidentiality requirements if sensitive data is exposed.

Mitigation Strategies

Update Google Chrome to version 155.0.8059.39 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-106390. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70