CVE-2026-106237
google chrome
Summary
Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
Published 2026-10-06 · first seen here 2026-10-10
Analysis & write-ups
No technical write-up from a research team yet. Contact Zero checks Unit 42, Google/Mandiant, Microsoft, Talos, CrowdStrike, Rapid7, watchTowr and others several times a day, plus NVD and CISA reference links.
Where it shows in your logs
Client software (browser, Office, PDF, archive tools) · Information disclosure or memory leak high confidence
What to look for
- One session or token used from several IPs or user agents (session hijacking)
- Logins with harvested credentials shortly after unusual requests to the vulnerable endpoint
- Unusually large responses to unauthenticated requests
- The vulnerable app starting script or command interpreters (e.g. winword.exe or chrome.exe spawning powershell.exe, cmd.exe, mshta.exe, wscript.exe)
- Files written to Startup folders, %AppData% or %Temp% right after opening a document or page
- Outbound connections from processes the vulnerable app spawned
- Related email delivery: attachments of the exploited file type, or links from the same campaign
Data sources
Process creation · ATT&CK DS0009 Process Creation
- Sentinel
DeviceProcessEventsSecurityEvent (4688)Sysmon Event ID 1_Im_ProcessCreate- Splunk
Endpoint.ProcessesXmlWinEventLog:Microsoft-Windows-Sysmon/OperationalWinEventLog:Security (4688)- CrowdStrike
ProcessRollup2SyntheticProcessRollup2
File creation · ATT&CK DS0022 File Creation
- Sentinel
DeviceFileEventsSysmon Event ID 11_Im_FileEvent- Splunk
Endpoint.FilesystemSysmon Event ID 11- CrowdStrike
NewExecutableWrittenNewScriptWritten*FileWritten events
Network connections · ATT&CK DS0029 Network Connection Creation / Network Traffic Flow
- Sentinel
DeviceNetworkEventsCommonSecurityLog (firewall)_Im_NetworkSession- Splunk
Network_Traffic.All_TrafficFirewall sourcetypes (pan:traffic, fortigate_traffic, cisco:asa)- CrowdStrike
NetworkConnectIP4NetworkReceiveAcceptIP4NetworkConnectIP6
Email delivery · ATT&CK DS0015 Application Log Content
- Sentinel
EmailEventsEmailAttachmentInfoEmailUrlInfo- Splunk
Email.All_Email- CrowdStrike
Falcon Next-Gen SIEM: email security connectors
Authentication and sessions · ATT&CK DS0028 Logon Session Creation / DS0002 User Account Authentication
- Sentinel
SigninLogsSecurityEvent (4624, 4625, 4648)DeviceLogonEventsIdentityLogonEvents_Im_Authentication- Splunk
Authentication.Authenticationpan:globalprotectVPN sourcetypes- CrowdStrike
UserLogonUserLogonFailed2Falcon Identity Protection events
Web server and WAF logs · ATT&CK DS0015 Application Log Content
- Sentinel
W3CIISLogAppServiceHTTPLogsAzureDiagnostics (Application Gateway / Front Door WAF)_Im_WebSession- Splunk
Web.Webms:iis:autoaccess_combinedWAF / proxy sourcetypes- CrowdStrike
Falcon Next-Gen SIEM: third-party web / WAF / proxy logs
A generic baseline worked out from the product type and weakness (CWE-200), not a detection. Check table and field names against your environment. Hunt queries for Sigma, Splunk, Sentinel and CrowdStrike are coming.