On October 6, 2026, NVD published two CVEs fixed in Google Chrome 155.0.8059.39: CVE-2026-106237 (site isolation bypass) and CVE-2026-106195 (Chromoting, Mac only).
What makes these two interesting isn't the mechanism. It's that the two sources rate them completely differently: NVD scores them 9.6 and 9.1, critical, while the Chromium security team rates both "Low". I won't settle it for them, but the gap is worth understanding.
| CVE | Component | CVSS 3.1 (NVD) | Vector | Chromium severity | NVD published | CISA KEV |
|---|---|---|---|---|---|---|
| CVE-2026-106237 | Permissions | 9.6 (CRITICAL) | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L | Low | 2026-10-06 | no (as of writing) |
| CVE-2026-106195 | Chromoting (Mac) | 9.1 (CRITICAL) | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | Low | 2026-10-06 | no (as of writing) |
CVE-2026-106237 — information leak in Permissions
Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page.
Site isolation puts each site in its own renderer process. It's one of the barriers that stop a malicious page from reading data belonging to another site open in the same browser. An information leak in the Permissions component could bypass that separation from a crafted HTML page. User interaction is required (UI:R): the victim has to visit the page.
CVE-2026-106195 — incorrect authorization in Chromoting, on Mac
Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic.
Chromoting is Chromium's internal name for the technology behind Chrome Remote Desktop. The bug only affects macOS. A remote attacker could bypass system access restrictions through crafted network traffic, with no user interaction. In practice, exposure mainly concerns Macs where remote access is set up.
Why NVD and Chromium Disagree
The two scales don't measure the same thing.
- NVD's CVSS scores a flaw's maximum theoretical impact from its description, often without knowing the exploitation conditions. "Site isolation bypass" or "bypass system access restrictions" translate mechanically into high impacts and a scope change.
- Chromium's severity is assigned by engineers who saw the bug and the fix. It accounts for real exploitation difficulty, preconditions, and the other protections still in place. "Low" usually means the flaw is unlikely to be exploitable on its own, or needs unusual conditions.
Both readings are plausible:
- Chromium is right and NVD's CVSS overstates the risk for lack of detail: common with browsers, whose bug reports stay restricted for weeks after the fix.
- NVD's CVSS reflects a worst case that Chromium considers unlikely but not impossible, for example chained with another flaw.
I don't have access to the bug report, and the NVD description isn't enough to decide. What matters in practice: the fix exists, it ships through the browser's normal update, and applying it is cheap. The rating gap doesn't change the decision. It only changes the priority your tooling displays: a scanner relying on NVD's CVSS will flag both as critical.
Versions
Both CVEs affect Google Chrome before 155.0.8059.39, the fixed version given by NVD. CVE-2026-106195 only affects Chrome on Mac.
Chromium-based browsers (Edge, Brave, Opera, Vivaldi…) generally pick up these fixes on their own schedule. Check each vendor's advisory: NVD doesn't list them here.
Detection
- Deployed version:
chrome://versionon a single machine, or better, your management console's inventory (Chrome Browser Cloud Management, Intune, Jamf, GPO) to find machines below 155.0.8059.39. - Machines that never restart the browser: Chrome downloads the update but only applies it on relaunch. That's the usual cause of lag.
- Chrome Remote Desktop on Mac: list Macs with the remote access host installed and confirm it's legitimate.
Mitigation
- Update Chrome to 155.0.8059.39 or later everywhere, and force a relaunch via the
RelaunchNotificationpolicy if you manage the fleet. - Uninstall the Chrome Remote Desktop host on Macs that don't need it, and restrict its use by policy on the others.
- Track Chromium-based browsers separately: their fix doesn't necessarily land the same day.
- Don't ignore a "Low" because Chromium considers it minor, and don't panic over a 9.6 because NVD calls it critical: either way, updating is the answer.
Why Continuous Monitoring of Your Browsers Matters
The browser is the most exposed software in the fleet, and its CVEs arrive weekly with ratings that often differ by source. Knowing which version actually runs on each machine is what lets you triage without trusting a single scale.
With cveo.tech, register your browsers and their versions, and get alerted whenever a critical CVE affects them.