CVE-2026-106188 in Chrome
Summary
by MITRE • 10/06/2026
Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified as a confused deputy flaw within the Google Chrome SignIn component on Android represents a significant authorization failure that allows unauthorized escalation of privileges through social engineering or remote exploitation techniques. This issue, resolved in version 155.0.8059.39 and classified with medium severity by Chromium security teams, stems from an improper check for user permissions during the authentication workflow. In this context, a confused deputy attack occurs when a trusted application or process is tricked into performing actions on behalf of an attacker without realizing that it has been deceived about the identity of the requester. Specifically, the SignIn mechanism failed to adequately verify whether the initiating request originated from a legitimate, user-initiated action versus a programmatic trigger generated by malicious content embedded in a web page.
From a technical perspective, the flaw resides in how Chrome handles state transitions and permission grants during the sign-in process on mobile devices. When a remote attacker hosts a crafted HTML page containing specific scripts or iframe injections, they can manipulate the browser's internal logic to bypass standard access restrictions. The malicious code exploits the trust relationship between the browser engine and the authentication service, causing the system to treat an unauthenticated or restricted context as if it were fully authenticated with elevated privileges. This allows the attacker to access privileged pages that should otherwise be inaccessible without proper user credentials or explicit consent. The attack vector is remote, meaning no physical access or prior compromise of the device is required beyond convincing a victim to visit the malicious webpage while using Chrome on Android.
The operational impact of this vulnerability is substantial as it compromises the integrity of the authentication boundary within the browser environment. By bypassing system access restrictions, an attacker can potentially gain unauthorized visibility into sensitive user data associated with signed-in accounts, such as saved passwords, browsing history, or personal information stored in synced services. Furthermore, if the privileged page allows for further interactions, the attacker might be able to perform actions on behalf of the victim without their knowledge, leading to potential account takeover scenarios or privacy violations. The medium severity rating reflects that while exploitation requires user interaction via a crafted web page, the resulting access to protected resources constitutes a serious breach of confidentiality and integrity principles within the application layer.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically where an actor is granted privileges they are not authorized to have due to flawed logic in permission checks. Additionally, it maps to MITRE ATT&CK techniques related to Initial Access via Spearphishing Link and potentially T1078 Valid Accounts if the attacker leverages the gained access to maintain persistence or move laterally within a compromised ecosystem. The confusion arises because the system fails to distinguish between legitimate user intent and automated script execution, violating the principle of least privilege by allowing lower-privilege contexts to invoke high-privilege functions without adequate validation.
Mitigation strategies primarily involve updating Google Chrome on Android devices to version 155.0.8059.39 or later, where these permission checks have been hardened to ensure that only direct user interactions can trigger privileged state changes. Security administrators should enforce automatic update policies for mobile browsers within organizational environments to minimize the window of exposure. For individual users, maintaining up-to-date software is critical as browser vendors frequently patch such logic errors before they can be widely exploited in the wild. Additionally, employing content security policies and sandboxing techniques where applicable can help limit the impact if a similar vulnerability were present in other components, although this specific issue requires a client-side update to resolve effectively.