PatchGap
Chrome · Contextual Tasks

CVE-2026-106301

Authorization Error in Contextual Tasks
Medium chrome Authorization Error 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactConfused deputy in Contextual Tasks
DescriptionConfused deputy in Contextual Tasks
ComponentContextual Tasks
Bug ClassAuthorization Error
Tracker523750306
Fix commitd58cbd80f41f (chromium/src) +37/-22
CISA KEVNot listed
CreditedGoogle
Disclosed2026-10-06

Files Changed

  • chrome/browser/contextual_tasks/contextual_tasks_page_handler.h
  • chrome/browser/contextual_tasks/contextual_tasks_page_handler_browsertest.cc
  • chrome/test/data/webui/contextual_tasks/test_contextual_tasks_browser_proxy.ts
  • chrome/test/data/webui/contextual_tasks/info_tooltip_test.ts
  • chrome/browser/contextual_tasks/contextual_tasks_page_handler.cc
  • chrome/browser/resources/contextual_tasks/info_tooltip.ts
  • chrome/test/data/webui/contextual_tasks/composebox_zero_state_test.ts
  • chrome/browser/contextual_tasks/contextual_tasks.mojom

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page