CVE-2026-106191
published 2026-10-06CVE-2026-106191: Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially…
PriorityP349high8.3CVSS 3.1
AVNACHPRNUIRSCCHIHAH
EPSS
0.36%
27.9th percentile
Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 155.0.8059.39 | 155.0.8059.39 | |
| chrome | >= 155.0.8059.39 < 155.0.8059.39 | 155.0.8059.39 | |
| chrome_desktop | — | — |
CVSS provenance
nvdv3.18.3HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
vendor_redhat8.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
chromium-browser: Missing authorization in Actor
vendor_redhat·2026-10-06·CVSS 8.3
CVE-2026-106191 [HIGH] CWE-862 chromium-browser: Missing authorization in Actor
chromium-browser: Missing authorization in Actor
A missing authorization flaw was found in the Actor component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=502282293
https://code.google.com/p/chromium/issues/detail?id=106191
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Chrome
Stable Channel Update for Desktop: CVE-2026-106312
vendor_chrome·2026-10-06·CVSS 8.3
CVE-2026-106312 [LOW] Stable Channel Update for Desktop: CVE-2026-106312
Stable Channel Update for Desktop
CVE-2026-106312: Missing authorization in SignIn. Reported by Google on 2026-04-13 [N/A][ 502282293 ] Low CVE-2026-106191: Missing authorization in Actor
Reported by Google on 2026-04-13 [N/A][ 502497790 ] Low CVE-2026-106250: Missing authorization in Actor
Severity: low
VulDB
Google Chrome up to 154.0.8037.97 Actor improper authorization (WID-SEC-2026-3761)
vuldb·2026-10-11·CVSS 8.3
CVE-2026-106191 [HIGH] Google Chrome up to 154.0.8037.97 Actor improper authorization (WID-SEC-2026-3761)
A vulnerability, which was classified as critical, has been found in Google Chrome. Affected by this issue is some unknown functionality of the component Actor. This manipulation causes improper authorization.
This vulnerability is registered as CVE-2026-106191. Remote exploitation of the attack is possible. No exploit is available.
It is advisable to upgrade the affected component.
GHSA
Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via
ghsa_unreviewed·2026-10-06
CVE-2026-106191 [HIGH] CWE-862 Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via
Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
No detection rules found.
No public exploits indexed.
2026-10-06
Published