CVE-2026-106237

CVE-2026-106237 allows remote attackers to bypass site isolation in Google Chrome via a crafted HTML page, exposing sensitive permission data.

This information leak bypasses Chrome's site isolation, allowing attackers to access cross-origin permission data. DIB organizations must ensure Chrome is patched to version 155.0.8059.39 or later, as unpatched browsers are a common entry point for credential theft and lateral movement. The failure stems from a known vulnerability that was not mitigated by keeping software updated.

Shame score — A known Chromium vulnerability with a low internal severity that was exploited remotely, indicating a failure to patch a widely tracked issue.