CVE-2026-106323
published 2026-10-06CVE-2026-106323: Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to…
PriorityP355critical9.6CVSS 3.1
AVNACLPRNUIRSCCHIHAH
EPSS
0.33%
24.4th percentile
Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 155.0.8059.39 | 155.0.8059.39 | |
| chrome | >= 155.0.8059.39 < 155.0.8059.39 | 155.0.8059.39 | |
| chrome_desktop | — | — |
CVSS provenance
nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
vendor_redhat9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Google Chrome up to 154.0.8037.97 improper authorization (EUVD-2026-93816)
vuldb·2026-10-07·CVSS 9.6
CVE-2026-106323 [CRITICAL] Google Chrome up to 154.0.8037.97 improper authorization (EUVD-2026-93816)
A vulnerability labeled as critical has been found in Google Chrome. This vulnerability affects unknown code. Executing a manipulation can lead to improper authorization.
This vulnerability is tracked as CVE-2026-106323. The attack can be launched remotely. No exploit exists.
The affected component should be upgraded.
GHSA
Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sand
ghsa_unreviewed·2026-10-06
CVE-2026-106323 [CRITICAL] CWE-862 Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sand
Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Chrome
Stable Channel Update for Desktop: CVE-2026-106396
vendor_chrome·2026-10-06·CVSS 9.6
CVE-2026-106396 [HIGH] Stable Channel Update for Desktop: CVE-2026-106396
Stable Channel Update for Desktop
CVE-2026-106396: Improper input validation in Omnibox. Reported by Google on 2026-08-25 [N/A][ 553114676 ] High CVE-2026-106323: Missing authorization in Chrome for iOS
Reported by Google on 2026-08-26 [N/A][ 553115993 ] High CVE-2026-106231: Uninitialized resource in Dawn
Severity: high
Red Hat
chromium-browser: Missing authorization in Chrome for iOS
vendor_redhat·2026-10-06·CVSS 9.6
CVE-2026-106323 [CRITICAL] CWE-862 chromium-browser: Missing authorization in Chrome for iOS
chromium-browser: Missing authorization in Chrome for iOS
Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
A missing authorization flaw was found in the Chrome for iOS component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/553114676
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
No detection rules found.
No public exploits indexed.
2026-10-06
Published