CVE-2026-106196 in Chrome
Summary
by MITRE • 10/06/2026
Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified as missing authorization in navigation within Google Chrome for iOS prior to version 155.0.8059.39 represents a significant breach of web origin policies, specifically targeting the browser's internal handling of cross-origin requests and frame navigations. This flaw allows a remote attacker to exploit improper access control mechanisms when navigating between different security contexts within the browser environment. By crafting a specific HTML page that leverages this misconfiguration, an adversary can trick the browser into treating content from an untrusted origin as if it originated from a privileged or trusted context. The core technical issue lies in the failure of the navigation controller to adequately verify authorization tokens or permissions before allowing a frame or window to load resources across domain boundaries where such access should be restricted by default security policies.
From a technical perspective, this vulnerability falls under the category of improper privilege management and cross-origin resource sharing failures. It aligns with CWE-284, which describes Improper Access Control, as well as CWE-913, specifically related to improper control of dynamically managed code resources. The attack vector relies on social engineering or malicious web content that initiates a navigation event where the browser fails to enforce strict origin checks. This allows scripts from an attacker-controlled domain to interact with elements or APIs belonging to a privileged page, effectively bypassing the Same-Origin Policy (SOP). In modern browsers, SOP is fundamental for preventing one website from accessing data from another without explicit permission; this flaw undermines that foundational security boundary by allowing unauthorized cross-origin interactions through navigation events.
The operational impact of this vulnerability is severe because it enables potential data exfiltration and session hijacking scenarios. An attacker who successfully exploits this issue could access sensitive information displayed in privileged pages, such as internal dashboards, user profiles, or administrative interfaces that are typically shielded from external scripts. Furthermore, the ability to manipulate DOM elements across origins can lead to clickjacking attacks where users are tricked into performing unintended actions on trusted sites. This compromises the integrity and confidentiality of web applications hosted within the browser session. The severity is rated as medium by Chromium security standards because while it requires user interaction or a crafted page to trigger, the potential for data theft and unauthorized state changes poses a substantial risk to end-users relying on Chrome for secure browsing activities.
Mitigation strategies primarily involve updating Google Chrome on iOS to version 155.0.8059.39 or later, where these navigation authorization checks have been hardened. For organizations deploying managed browsers, ensuring that automatic updates are enabled is critical to maintaining this security posture. Additionally, developers of web applications should implement robust Content Security Policy (CSP) directives to restrict unauthorized script execution and frame nesting, providing an additional layer of defense even if browser-level vulnerabilities exist. Monitoring for unusual cross-origin requests in network logs can also help detect exploitation attempts. The vulnerability is mapped to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, as it facilitates the execution of malicious logic within a trusted context, and relates to TA0004, Impact, specifically regarding data exfiltration and unauthorized access.