Is CVE-2026-106425 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106425 being exploited in the wild.

How severe is CVE-2026-106425?

Informational severity, published 6 October 2026.

Which products and versions are affected?

Google Chrome prior to 155.0.8059.39.

Is there a fix for CVE-2026-106425?

Yes: fixed in 155.0.8059.39. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106425 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-106425?

Check whether you run Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106425: Google Chrome missing authorization in BrowserTag

CVE-2026-106425 · Severity: info · Published 2026-10-06

Google Chrome is a web browser used by billions of users worldwide. A missing authorization vulnerability in the BrowserTag feature could allow a remote attacker to bypass site isolation (Chrome's security boundary between websites) if they had already compromised the renderer process and tricked a user with social engineering. This could lead to cross-site data theft or unauthorized access between websites.

Technologies: Google Chrome. Vendors: Google.

Quick answers

Is CVE-2026-106425 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106425 being exploited in the wild.
How severe is CVE-2026-106425?: Informational severity, published 6 October 2026.
Which products and versions are affected?: Google Chrome prior to 155.0.8059.39.
Is there a fix for CVE-2026-106425?: Yes: fixed in 155.0.8059.39. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106425 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-106425?: Check whether you run Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 155.0.8059.39

Technical details

The vulnerability is a missing authorization check in the BrowserTag component in Google Chrome prior to version 155.0.8059.39. An attacker who had already compromised the renderer process could exploit this via a crafted HTML page combined with social engineering to bypass site isolation. A fix is available in Chrome 155.0.8059.39 and later.

Affected products

Google Chrome prior to 155.0.8059.39

Timeline

2026-10-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.