CVE-2026-106359 – Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 a

Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)