CVE-2026-106228
published 2026-10-06CVE-2026-106228: Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially…
PriorityP349high8.3CVSS 3.1
AVNACHPRNUIRSCCHIHAH
EPSS
0.36%
27.9th percentile
Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 155.0.8059.39 | 155.0.8059.39 | |
| chrome | >= 155.0.8059.39 < 155.0.8059.39 | 155.0.8059.39 | |
| chrome_desktop | — | — |
CVSS provenance
nvdv3.18.3HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
vendor_redhat8.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Chrome
Stable Channel Update for Desktop: CVE-2026-106201
vendor_chrome·2026-10-06·CVSS 8.8
CVE-2026-106201 [MEDIUM] Stable Channel Update for Desktop: CVE-2026-106201
Stable Channel Update for Desktop
CVE-2026-106201: Race condition in V8. Reported by Google on 2026-05-28 [N/A][ 517649552 ] Medium CVE-2026-106333: Incorrect authorization in Input
Reported by Google on 2026-05-28 [N/A][ 517689673 ] Medium CVE-2026-106228: Confused deputy in Google Lens
Severity: medium
Red Hat
chromium-browser: Confused deputy in Google Lens
vendor_redhat·2026-10-06·CVSS 8.3
CVE-2026-106228 [HIGH] CWE-441 chromium-browser: Confused deputy in Google Lens
chromium-browser: Confused deputy in Google Lens
Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
A confused deputy flaw was found in the Google Lens component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/517689673
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
GHSA
Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via
ghsa_unreviewed·2026-10-06
CVE-2026-106228 [HIGH] CWE-441 Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via
Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
No detection rules found.
No public exploits indexed.
2026-10-06
Published