Description
Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)
Published: 2026-10-06
Score: 4.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation (local)
Action: Patch
AI Analysis

Impact

This vulnerability is a confused‑deputy flaw in the user interface of Google Chrome on Android that lets a local attacker sidestep system access controls and reach a privileged page through a co‑installed application. The flaw allows the attacker to exercise higher privileges than the installed app normally possesses, effectively escalating locally within the device.

Affected Systems

Google Chrome for Android versions earlier than 155.0.8059.39 are affected.

Risk and Exploitability

The attack requires the presence of a co‑installed application and local access to the device. The EPSS score is < 1%, and it is not listed in the CISA KEV catalog. The severity is rated medium. An attacker who can install or influence another app on the device can trigger the vulnerability to access privileged pages and potentially compromise the user’s data or the device’s integrity.

Generated by OpenCVE AI on October 7, 2026 at 14:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome to version 155.0.8059.39 or later
  • Remove or disable any co‑installed application that could exploit the flaw
  • Ensure that Android device restrictions prevent untrusted apps from gaining elevated UI access

Generated by OpenCVE AI on October 7, 2026 at 14:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Fri, 09 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Confused deputy in UI
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 07 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Chrome for Android via Co‑installed App

Wed, 07 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Wed, 07 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 07 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Chrome for Android via Co‑installed App

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)
Weaknesses CWE-441
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-08T15:54:47.566Z

Reserved: 2026-10-06T16:35:26.892Z

Link: CVE-2026-106326

cve-icon Vulnrichment

Updated: 2026-10-08T15:53:31.971Z

cve-icon NVD

Status : Modified

Published: 2026-10-06T19:18:00.900

Modified: 2026-10-08T16:17:02.897

Link: CVE-2026-106326

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-06T18:41:21Z

Links: CVE-2026-106326 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T14:45:02Z

Weaknesses
  • CWE-441

    Unintended Proxy or Intermediary ('Confused Deputy')